Open Source Vulnerabilities
net.minidev:json-smart
TuxCare security update for net.minidev:json-smart (1 CVE)
net.minidev:json-smart
TuxCare security update for net.minidev:json-smart (1 CVE)
ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header
ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header
tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
tsParticles: Generated release notes can execute shell commands in the stable publish workflow
tsParticles: Generated release notes can execute shell commands in the stable publish workflow
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
Sandboxie-Plus: Sandbox containment bypass
Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller
Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller
Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)
Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)
Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy
Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy
Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview
Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview
Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)
Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)
h2o: buffer overflow when using the %{error}x log directive
GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover
GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover
nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write
nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write
nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files
nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files
nvm prints the contents of any readable file through a symlinked .nvmrc
nvm prints the contents of any readable file through a symlinked .nvmrc
yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management
yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management
nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable
nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable
nvm install --offline installs a cached tarball that previously failed checksum verification
nvm install --offline installs a cached tarball that previously failed checksum verification
nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line
nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line
nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases
nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
