Open Source Vulnerabilities
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation
NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation
Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise
Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise
Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink
Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink
jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters
jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters
FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode
FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode
NPC-Worldwide npcpy sft.py load_sft_model code injection
draw.io: Prototype pollution in GraphML (mxGraphMlCodec)
draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts
draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts
Traccar: Authentication bypass via path parameters exposes protected device media
Traccar: Authentication bypass via path parameters exposes protected device media
SumatraPDF: TLS hostname validation disabled in `HttpGet()`
kernel-livepatch-SLE15-SP4_Update_60, kernel-livepatch-SLE15-SP6_Update_32
Security update for the Linux Kernel (Live Patch 32 for SUSE Linux Enterprise 15 SP6)
kernel-livepatch-SLE15-SP4_Update_60/ kernel-livepatch-SLE15-SP6_Update_32
Security update for the Linux Kernel (Live Patch 32 for SUSE Linux Enterprise 15 SP6)
ProxySQL: Uninitialized heap read in MySQL compressed packet decompression via zlib path
ProxySQL: Uninitialized heap read in MySQL compressed packet decompression via zlib path
Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets
Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets
WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints
WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints
Trawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypass
Trawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypass
blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset
blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass
Powerlevel10k before 1.20.19 Insecure Temporary Directory via gitstatus Installer
Powerlevel10k before 1.20.19 Insecure Temporary Directory via gitstatus Installer
Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File
Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File
Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.program
Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.program
Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers
Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers
Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe
Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe
go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware
go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware
Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key
Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key
CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin
CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin
CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder
CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder
