Open Source Vulnerabilities
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication
secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication
Coop sessions are not invalidated on password reset
Coop has SAML cross-tenant authentication bypass
Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser
Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser
Coop has a data leak via unauthenticated GraphQL Query.allOrgs
Coop has a data leak via unauthenticated GraphQL Query.allOrgs
Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg
Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg
i18next: Shared built-in corruption through inherited-key deepExtend recursion
i18next: Shared built-in corruption through inherited-key deepExtend recursion
IXP Manager has authenticated non-administrator privilege escalation
IXP Manager has authenticated non-administrator privilege escalation
IXP Manager has Broken Object-Level Authorization
OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution
OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution
TAKO AI Agent for Okta: Authenticated Python execution through validator bypass
TAKO AI Agent for Okta: Authenticated Python execution through validator bypass
TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover
TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover
Refitter: C# source injection through OpenAPI header parameter names
Refitter: C# source injection through OpenAPI header parameter names
Refitter: C# source injection through OpenAPI content-type map keys
Refitter: C# source injection through OpenAPI content-type map keys
Refitter: C# source injection through OpenAPI path keys
sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites
sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites
Aedes has Uncaught Exception and Uncontrolled Resource Consumption
Aedes has Uncaught Exception and Uncontrolled Resource Consumption
Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules
Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules
LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration
LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration
OpenRemote has authenticated SQL injection in crosstab datapoint exports
OpenRemote has authenticated SQL injection in crosstab datapoint exports
netopeer2-server logging has format string vulnerability via subtree filter
netopeer2-server logging has format string vulnerability via subtree filter
uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset
uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset
uhttpd: HTTP request smuggling via ubus POST body parse-error desync
uhttpd: HTTP request smuggling via ubus POST body parse-error desync
