Open Source Vulnerabilities

opensearch-dashboards-3-fips-dashboards-observability

cassandra-medusa

cassandra-medusa

cassandra-medusa

cassandra-medusa

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Security fix for GHSA-5qcv-4rpc-jp93 applied in: druid-fips 34.0.0-r2, druid-fips 35.0.1-r2, druid-fips 36.0.0-r1, druid-fips 32.0.1-r2, druid-fips 33.0.0-r2

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Security fix for GHSA-445c-vh5m-36rj applied in: druid-fips 34.0.0-r2, druid-fips 35.0.1-r2, druid-fips 36.0.0-r1, druid-fips 32.0.1-r2, druid-fips 33.0.0-r2

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Security fix for GHSA-3pxv-7cmr-fjr4 applied in: druid-fips 34.0.0-r2, druid-fips 35.0.1-r2, druid-fips 36.0.0-r1, druid-fips 32.0.1-r2, druid-fips 33.0.0-r2

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

PAC4J is vulnerable to Cross-Site Request Forgery (CSRF)

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Apache Log4j Core's XmlLayout https://logging

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Apache Log4j Core's Rfc5424Layout https://logging

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

fix for CVE-2025-68161 https://logging

druid-fips, druid-fips, druid-fips, druid-fips

pgjdbc is an open source postgresql JDBC Driver

commitizen

druid-fips

Schema parsing in the parquet-avro module of Apache Parquet 1

consul, consul, gatekeeper, gatekeeper-fips, minio, gcp-compute-persistent-disk-csi-driver-fips

Security fix for GHSA-mh2q-q3fh-2475 applied in: consul 1.22.7-r0, consul 1.22.7-r2, gatekeeper 3.20.1-r1, gatekeeper-fips 3.20.1-r1, minio 0.20251015.172955-r2, gcp-compute-persistent-disk-csi-driver-fips 1.25.0-r0

consul, gatekeeper, gatekeeper-fips, minio, gcp-compute-persistent-disk-csi-driver-fips

Security fix for GHSA-p77j-4mvh-x3m3 applied in: consul 1.22.5-r1, gatekeeper 3.20.1-r1, gatekeeper-fips 3.20.1-r1, minio 0.20251015.172955-r1, gcp-compute-persistent-disk-csi-driver-fips 1.25.0-r0

step-cli, consul, consul, etcd, gatekeeper-fips, minio, gatekeeper, gcp-compute-persistent-disk-csi-driver-fips

OpenTelemetry-Go is the Go implementation of OpenTelemetry

vitess-23, vitess-23

vitess-23, vitess-23

tileserver-gl-fips

tileserver-gl-fips

tileserver-gl-fips

tileserver-gl-fips

tileserver-gl-fips

tileserver-gl-fips

frappe-helpdesk

Vite is a frontend tooling framework for JavaScript

frappe-helpdesk

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree

frappe-helpdesk

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions

py3-twisted

twisted is an event-driven networking engine written in Python

frappe-helpdesk

Security fix for GHSA-67mh-4wv8-2f99 applied in: frappe-helpdesk 1.22.0-r0

frappe-helpdesk

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG

py3-twisted

Twisted is an event-based framework for internet applications, supporting Python 3

frappe-helpdesk

Babel is a compiler for writing next generation JavaScript

frappe-helpdesk

Security fix for GHSA-5c6j-r48x-rmvq applied in: frappe-helpdesk 1.22.0-r0

langfuse-3-worker, langfuse-3-worker

langfuse-3-worker, langfuse-3-worker

langfuse-3-worker, langfuse-3-worker

langfuse-3-worker, langfuse-3-worker

langfuse-3-worker, langfuse-3-worker

step-cli, grafana-fips

Memory-safety vulnerability in github

bubblewrap

Bubblewrap (bwrap) before version 0

py3-prometheus-client

Security fix for GHSA-grgv-6hw6-v9g4 applied in: py3-prometheus-client 0.25.0-r0

bubblewrap

Flatpak is a Linux application sandboxing and distribution framework

py3-prometheus-client

Twisted is an event-based framework for internet applications, supporting Python 3