Open Source Vulnerabilities

nss

cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content

nss

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur

nettle

flaw was found in Nettle in versions before 3

cairo

cairo 1

nettle

flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext

cairo

flaw was found in cairo's image-compositor

cairo

issue was discovered in cairo 1

kyverno-policy-reporter-ui-fips, kyverno-policy-reporter-ui-fips, kyverno-policy-reporter-ui-fips, cloudflared

Security fix for GHSA-mqqf-5wvp-8fh8 applied in: kyverno-policy-reporter-ui-fips 2.5.1-r0, kyverno-policy-reporter-ui-fips 2.3.10-r0, kyverno-policy-reporter-ui-fips 2.4.4-r2, cloudflared 2025.11.1-r2

nss

flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3

nss

flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1

aspell

libaspell

nss

NSS (Network Security Services) versions prior to 3

aspell

objstack in GNU Aspell 0

nodetaint, opentofu

tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing

curl

In libexpat before 2

nss

NSS was susceptible to a timing side-channel attack when performing RSA decryption

nodetaint, opentofu

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component

curl

In libexpat before 2

kyverno-policy-reporter-ui, opentofu

golang-jwt is a Go implementation of JSON Web Tokens

curl

1

opentofu

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

curl

curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says

opentofu

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

opentofu, opentofu

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries

opentofu, opentofu

xz is a pure golang package for reading and writing xz-compressed files

kyverno-policy-reporter-ui, opentofu, opentofu

flaw was found in github

nodetaint, promu, opentofu, opentofu

attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

gatekeeper-fips, grafana, grafana, minio, gatekeeper, grafana, grafana, grafana, grafana, grafana, grafana, grafana, grafana, opentofu, opentofu

OpenTelemetry-Go is the Go implementation of OpenTelemetry

argo-workflows-ui-4.0, argo-workflows-ui-4.0

argo-workflows-ui-4.0, argo-workflows-ui-4.0

opentofu, opentofu

flaw was found in CIRCL's implementation of the FourQ elliptic curve

grafana, grafana, grafana, grafana, grafana, grafana, grafana, grafana, grafana, opentofu, opentofu

CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs

dotnet-9

Security fix for GHSA-w3q9-fxm7-j8fq applied in: dotnet-9 9.0.113-r1

dotnet-9

Security fix for GHSA-h4j7-5rxr-p4wc applied in: dotnet-9 9.0.113-r1

python3

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427

dotnet-9

External control of file name or path in

python3

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory

vllm-openai-cuda-12.9

vllm-openai-cuda-12.9

vllm-openai-cuda-12.9

vllm-openai-cuda-12.9

grafana, grafana

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

grafana, grafana

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

gatekeeper-fips, grafana, grafana, gatekeeper, minio, grafana, grafana, cloudflared

Security fix for GHSA-9h8m-3fm2-qjrq applied in: gatekeeper-fips 3.20.1-r1, grafana 12.2.6-r0, grafana 12.2.7-r0, gatekeeper 3.20.1-r1, minio 0.20251015.172955-r1, grafana 12.1.8-r0, grafana 12.1.9-r0, cloudflared 2025.11.1-r2

minio, grafana, grafana, grafana, grafana, grafana, grafana

Security fix for GHSA-6g7g-w4f8-9c9x applied in: minio 0.20251015.172955-r1, grafana 12.0.9-r1, grafana 12.1.6-r0, grafana 12.1.8-r1, grafana 12.2.4-r1, grafana 12.2.6-r1, grafana 12.3.4-r0

trivy

Security fix for GHSA-whqx-f9j3-ch6m applied in: trivy 0.67.2-r1

trivy

Security fix for GHSA-4qg8-fj49-pxjh applied in: trivy 0.67.2-r1

coredns-fips, step-cli, gatekeeper, gatekeeper-fips, trivy, newrelic-k8s-metadata-injection, nats-server-fips, kyverno-policy-reporter-ui-fips, nats-server-fips, grafana, nats-server-fips, grafana, grafana, grafana, grafana, grafana, grafana

Actions which insert URLs into the content attribute of HTML meta tags are not escaped

grafana, trivy, grafana, grafana, grafana

go-git is a highly extensible git implementation library written in pure Go

prism, prism