Open Source Vulnerabilities

joserfc

joserfc

github.com/go-jose/go-jose/v4

github.com/go-jose/go-jose/v4

filelock

filelock

filelock

filelock

filelock

filelock

filelock

filelock

filelock

filelock

filelock

filelock

twisted

hugo

hugo-0.169.0-1.1 on GA media

warewulf4

warewulf4-4.7.1-2.1 on GA media

Field Collection for Drupal 7 access bypass via missing parent entity access check

assent,

Unverified Sign in with Apple callback parameter can override verified ID token claims

Unverified Sign in with Apple callback parameter can override verified ID token claims

localstack

localstack

python-3.13, python-3.13

org.eclipse.jetty.aggregate:jetty-all, org.eclipse.jetty.fcgi:fcgi-client, org.eclipse.jetty.fcgi:fcgi-parent, org.eclipse.jetty.fcgi:fcgi-server, org.eclipse.jetty.gcloud:gcloud-parent, org.eclipse.jetty.gcloud:jetty-gcloud-session-manager, org.eclipse.jetty.http2:http2-client, org.eclipse.jetty.http2:http2-common, org.eclipse.jetty.http2:http2-hpack, org.eclipse.jetty.http2:http2-http-client-transport, org.eclipse.jetty.http2:http2-parent, org.eclipse.jetty.http2:http2-server, org.eclipse.jetty.memcached:jetty-memcached-sessions, org.eclipse.jetty.memcached:memcached-parent, org.eclipse.jetty.osgi:jetty-httpservice, org.eclipse.jetty.osgi:jetty-osgi-alpn, org.eclipse.jetty.osgi:jetty-osgi-boot, org.eclipse.jetty.osgi:jetty-osgi-boot-jsp, org.eclipse.jetty.osgi:jetty-osgi-boot-warurl, org.eclipse.jetty.osgi:jetty-osgi-project, org.eclipse.jetty.osgi:test-jetty-osgi-webapp-resources, org.eclipse.jetty.websocket:javax-websocket-client-impl, org.eclipse.jetty.websocket:javax-websocket-server-impl, org.eclipse.jetty.websocket:jetty-websocket-tests, org.eclipse.jetty.websocket:websocket-api, org.eclipse.jetty.websocket:websocket-client, org.eclipse.jetty.websocket:websocket-common, org.eclipse.jetty.websocket:websocket-parent, org.eclipse.jetty.websocket:websocket-server, org.eclipse.jetty.websocket:websocket-servlet, org.eclipse.jetty:apache-jsp, org.eclipse.jetty:apache-jstl, org.eclipse.jetty:infinispan-common, org.eclipse.jetty:infinispan-embedded, org.eclipse.jetty:infinispan-embedded-query, org.eclipse.jetty:infinispan-parent, org.eclipse.jetty:infinispan-remote, org.eclipse.jetty:infinispan-remote-query, org.eclipse.jetty:jetty-alpn-client, org.eclipse.jetty:jetty-alpn-conscrypt-client, org.eclipse.jetty:jetty-alpn-conscrypt-server, org.eclipse.jetty:jetty-alpn-java-client, org.eclipse.jetty:jetty-alpn-java-server, org.eclipse.jetty:jetty-alpn-openjdk8-client, org.eclipse.jetty:jetty-alpn-openjdk8-server, org.eclipse.jetty:jetty-alpn-parent, org.eclipse.jetty:jetty-alpn-server, org.eclipse.jetty:jetty-annotations, org.eclipse.jetty:jetty-ant, org.eclipse.jetty:jetty-bom, org.eclipse.jetty:jetty-cdi, org.eclipse.jetty:jetty-client, org.eclipse.jetty:jetty-continuation, org.eclipse.jetty:jetty-deploy, org.eclipse.jetty:jetty-distribution, org.eclipse.jetty:jetty-documentation, org.eclipse.jetty:jetty-hazelcast, org.eclipse.jetty:jetty-home, org.eclipse.jetty:jetty-http, org.eclipse.jetty:jetty-http-spi, org.eclipse.jetty:jetty-io, org.eclipse.jetty:jetty-jaas, org.eclipse.jetty:jetty-jaspi, org.eclipse.jetty:jetty-jmx, org.eclipse.jetty:jetty-jndi, org.eclipse.jetty:jetty-jspc-maven-plugin, org.eclipse.jetty:jetty-maven-plugin, org.eclipse.jetty:jetty-nosql, org.eclipse.jetty:jetty-openid, org.eclipse.jetty:jetty-plus, org.eclipse.jetty:jetty-project, org.eclipse.jetty:jetty-proxy, org.eclipse.jetty:jetty-quickstart, org.eclipse.jetty:jetty-rewrite, org.eclipse.jetty:jetty-runner, org.eclipse.jetty:jetty-security, org.eclipse.jetty:jetty-server, org.eclipse.jetty:jetty-servlet, org.eclipse.jetty:jetty-servlets, org.eclipse.jetty:jetty-spring, org.eclipse.jetty:jetty-start, org.eclipse.jetty:jetty-unixsocket, org.eclipse.jetty:jetty-util, org.eclipse.jetty:jetty-util-ajax, org.eclipse.jetty:jetty-webapp, org.eclipse.jetty:jetty-xml

TuxCare security update for 86 packages (1 CVE)

consul-1.22

consul-1.22

consul-1.22

consul-1.22

consul-1.22

consul-1.22

consul-1.22

node-i18next, node-i18next, node-i18next

rust-sevenz-rust2

node-i18next, node-i18next, node-i18next, node-i18next, node-i18next

rust-sevenz-rust2

github.com/kubeflow/pipelines, github.com/kubeflow/pipelines

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

github.com/kubeflow/pipelines, github.com/kubeflow/pipelines

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

pypdf

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

pypdf

pypdf has possible large memory usage when parsing page tree

pypdf

pypdf has possible infinite loop when cloning dictionaries

joi, @hapi/joi, joi

joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

@hapi/content, content

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

minimatch

minimatch has potential denial of service via globparts amplification

glob

Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

authlib

Authlib RFC 7592 examples omit registration-access-token client binding

pypdf

pypdf has possible long runtimes when retrieving page labels

pypdf

pypdf has possible large memory usage for exceptions in strict mode

pypdf

pypdf has possible long runtimes/large memory usage for encrypted PDF files