Open Source Vulnerabilities

argo-workflow-executor-4.1

Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion

LightSAML: Signature reference wrapping permits unsigned assertion claims

Element Call exposes shared passwords in logs

ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts

LORIS has incorrect access checks in issue_tracker

LORIS has incorrect access checks in API for Imaging Browser

Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis

sabnzbdplus, sabnzbdplus, sabnzbdplus

sabnzbdplus, sabnzbdplus, sabnzbdplus, sabnzbdplus, sabnzbdplus, sabnzbdplus

tesseract, tesseract, tesseract

tesseract, tesseract, tesseract

tesseract, tesseract, tesseract

tesseract, tesseract, tesseract

rebar3, rebar3, rebar3

Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables

tesseract, tesseract, tesseract, tesseract, tesseract, tesseract, tesseract, tesseract

tesseract, tesseract, tesseract, tesseract, tesseract, tesseract, tesseract, tesseract

tesseract, tesseract, tesseract, tesseract, tesseract, tesseract, tesseract, tesseract

tesseract, tesseract, tesseract, tesseract, tesseract, tesseract, tesseract, tesseract

Shopper: customer detail IDOR exposes administrator and staff records

Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation

Shopper: missing variant-delete authorization permits destructive single and bulk actions

Picotls has NULL pointer dereference during handshake, when running as a client

ag-psd has uncontrolled memory allocation via declared PSD dimensions (DoS)

jack: upstream error responses expose backend and peer credentials

ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser

ESPAsyncWebServer multipart parser has null-pointer write

SABnzbd: Orphan-job path traversal permits arbitrary file deletion

libriscv: Out of bounds read vuln in the ELF parser (Denial of service)

Dream Displays has command-line argument injection in yt-dlp invocation

Picsou vulnerable to login timing attack

LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling

LibreDWG: unbounded allocation in pre-R13 DWG entity decoding

LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing

Ring's nested-params middleware has inefficient regular expression complexity

MoLing: unauthenticated SSE and wildcard CORS expose tool sessions

Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read

NovumOS: Nova Interpreter Privilege Escalation

ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection

Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass

ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks

Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

phoenix_html,

Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

Tesseract: File-controlled pointers still reach `delete` in ADAPT_CLASS_STRUCT destructor

pypa/gh-action-pypi-publish

pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)

Tesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer comparison bypass allows negative dimensions

ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

ssl_verify_fun,

ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary