Open Source Vulnerabilities

github.com/etcd-io/etcd, github.com/etcd-io/etcd

Improper Preservation of Permissions in etcd

github.com/grafana/grafana

Grafana XSS via adding a link in General feature

github.com/grafana/grafana

Grafana XSS in Dashboard Text Panel

github.com/hashicorp/vault

HashiCorp Vault Improper Privilege Management

github.com/hashicorp/vault

HashiCorp Vault Improper Privilege Management

qt5-qtwebengine, qt5-qtwebengine, qt5-qtwebengine, qt5-qtwebengine, qt5-qtwebengine, qt6-qtwebengine, qt6-qtwebengine, qt6-qtwebengine, qt6-qtwebengine, qt6-qtwebengine, qt6-qtwebengine

chromium, chromium, chromium

qt5-qtwebengine, qt5-qtwebengine, qt5-qtwebengine, qt5-qtwebengine, qt5-qtwebengine, qt6-qtwebengine, qt6-qtwebengine, qt6-qtwebengine, qt6-qtwebengine, qt6-qtwebengine, qt6-qtwebengine

chromium, chromium, chromium

qt5-qtwebengine, qt5-qtwebengine, qt5-qtwebengine, qt5-qtwebengine, qt5-qtwebengine, qt6-qtwebengine, qt6-qtwebengine, qt6-qtwebengine, qt6-qtwebengine, qt6-qtwebengine, qt6-qtwebengine

chromium, chromium, chromium

Discourse improperly sanitized user input leads to XSS

linux-nvidia

linux-nvidia vulnerabilities

vyper

TrueLayer.Client

TrueLayer.Client SSRF when fetching payment or payment provider

github.com/goreleaser/goreleaser

`goreleaser release --debug` shows secrets

@apollo/experimental-nextjs-app-support

@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability

@urql/next

@urql/next Cross-site Scripting vulnerability

@tanstack/react-query-next-experimental

react-query-streamed-hydration Cross-site Scripting vulnerability

io.crate:crate, io.crate:crate, io.crate:crate, io.crate:crate

CrateDB database has an arbitrary file read vulnerability

python-pillow

Updated python-pillow packages fix a security vulnerability

zlib

Updated zlib packages fix a security vulnerability

vantage6

vantage6 may create unencrypted tasks in encrypted collaboration

vantage6-server

vantage6 vulnerable to username timing attack

vantage6

vantage6 has insecure SSH configuration for node and server containers

vantage6

vantage6 remote code execution vulnerability

github.com/0xJacky/Nginx-UI

Arbitrary command execution in github.com/0xJacky/Nginx-UI

raw_call `value=` kwargs not disabled for static and delegate calls

react-query-streamed-hydration xss

vyper

Vyper's raw_call `value=` kwargs not disabled for static and delegate calls

XSS in @urql/next

pkcs11-provider, pkcs11-provider

pkcs11-provider

XSS in @apollo/experimental-nextjs-app-support

Pkcs11-provider: side-channel proofing pkcs#1 1.5 paths

CrateDB database has an arbitrary file read vulnerability

`goreleaser release --debug` shows secrets

TrueLayer.Client SSRF when fetching payment or payment provider

github.com/bincyber/go-sqlcrypter

IV collision in github.com/bincyber/go-sqlcrypter

TablePress SSRF vulnerability due to insufficient filtering of cloud provider hosts

modsecurity, modsecurity, modsecurity