Open Source Vulnerabilities
wso2mi, wso2mi, wso2mi
vulnerability was found in ESAPI esapi-java-legacy and classified as problematic
wso2mi/ wso2mi/ wso2mi
vulnerability was found in ESAPI esapi-java-legacy and classified as problematic
wso2mi, wso2mi, wso2mi
netty-tcnative 2
wso2mi, wso2mi, wso2mi
jsoup is a Java library for working with real-world HTML
wso2mi/ wso2mi/ wso2mi
jsoup is a Java library for working with real-world HTML
wso2mi, wso2mi, wso2mi
jsoup through 1
wso2mi, wso2mi, wso2mi
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates
wso2mi/ wso2mi/ wso2mi
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates
npm
Glob matches files using patterns the shell uses
npm
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects
npm
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects
npm
undici is an HTTP client library for Node
npm
undici is an HTTP client library for Node
npm
undici is an HTTP client library for Node
npm
undici is an HTTP client library for Node
npm
undici is an HTTP client library for Node
npm
undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...
npm
undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...
npm
undici's WebSocket client crashes the whole Node
npm
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers
npm
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers
npm
undici's setCookie function does not fully sanitize cookie attributes
npm
undici's setCookie function does not fully sanitize cookie attributes
npm
undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response
npm
undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response
npm
undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1
npm
undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1
caddy
In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http
caddy
In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http
grafana-alloy
OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages
grafana-alloy
OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages
grafana-alloy
Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...
grafana-alloy
Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...
grafana-alloy
CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/ru...
grafana-alloy
CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/ru...
mailpit
Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer
mailpit
Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer
nginx-prometheus-exporter-fips
attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing
nginx-prometheus-exporter-fips
attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing
trino, opentelemetry-collector-contrib
buffer overflow vulnerability in the Brotli decoder (c/dec/decode
trino/ opentelemetry-collector-contrib
buffer overflow vulnerability in the Brotli decoder (c/dec/decode
trino
Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs
trino
Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs
trino
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)
trino
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)
trino
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine
trino
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine
trino
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes
trino
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes
trino
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable
trino
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable
nodejs-packaging
Moderate: nodejs:18 security, bug fix, and enhancement update
nodejs-packaging
Moderate: nodejs:18 security, bug fix, and enhancement update
qt5-qtsvg
Low: qt5-qtsvg security update
axios, @rootio/axios
AIKIDO-2026-291630 in axios - Patched by Root
axios/ @rootio/axios
AIKIDO-2026-291630 in axios - Patched by Root
axios, @rootio/axios
CVE-2026-101909 in axios - Patched by Root
axios/ @rootio/axios
CVE-2026-101909 in axios - Patched by Root
axios, @rootio/axios
CVE-2026-101902 in axios - Patched by Root
axios/ @rootio/axios
CVE-2026-101902 in axios - Patched by Root
xregexp, @rootio/xregexp
AIKIDO-2025-10109 in xregexp - Patched by Root
xregexp/ @rootio/xregexp
AIKIDO-2025-10109 in xregexp - Patched by Root
async, @rootio/async
CVE-2021-43138 in async - Patched by Root
async/ @rootio/async
CVE-2021-43138 in async - Patched by Root
qs, @rootio/qs
CVE-2022-24999 in qs - Patched by Root
qs/ @rootio/qs
CVE-2022-24999 in qs - Patched by Root
