Open Source Vulnerabilities
Stored XSS via HTML scrubber rule in RTIR
argo-workflows
Security fix for GHSA-73rr-hh4g-fpgx applied in: argo-workflows 3.6.19-r5
argo-workflows
Security fix for GHSA-73rr-hh4g-fpgx applied in: argo-workflows 3.6.19-r5
renovate, renovate, renovate
node-tar is a tar archive manipulation library for Node
renovate/ renovate/ renovate
node-tar is a tar archive manipulation library for Node
qt3d-opensource-src, qt3d-opensource-src, qt3d-opensource-src, qt6-3d, qt6-3d, qt6-3d
qt3d-opensource-src/ qt3d-opensource-src/ qt3d-opensource-src/ qt6-3d/ qt6-3d/ qt6-3d
Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()
Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()
Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via blo_bhead_id Accessors
Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via blo_bhead_id Accessors
Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB Block
Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB Block
Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction
Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction
Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache
Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache
pybars4 through 0.9.13 Code Injection via Bracketed Path Segments
pybars4 through 0.9.13 Code Injection via Bracketed Path Segments
pybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed Path Segments
pybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed Path Segments
NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers
NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers
My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter
My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter
Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands
Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header
PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header
PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route
PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route
Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata
Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata
abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name
abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name
SonicJS through 3.0.0 Missing Authorization in Content Write API
SonicJS through 3.0.0 Missing Authorization in Content Write API
LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
SerpBear before 3.1.1 Missing Authentication via POST /api/notify
SerpBear before 3.1.1 Missing Authentication via POST /api/notify
Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp
Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp
xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header
xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header
WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation
WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation
WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations
WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations
WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations
WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations
WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS
WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS
Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Memory Access via SVM Import Plugin
Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Memory Access via SVM Import Plugin
qt3d-opensource-src, qt3d-opensource-src, qt3d-opensource-src, qt3d-opensource-src, qt6-3d, qt3d-opensource-src, qt6-3d, qt3d-opensource-src, qt6-3d, qt3d-opensource-src, qt6-3d
qt3d-opensource-src/ qt3d-opensource-src/ qt3d-opensource-src/ qt3d-opensource-src/ qt6-3d/ qt3d-opensource-src/ qt6-3d/ qt3d-opensource-src/ qt6-3d/ qt3d-opensource-src/ qt6-3d
Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking
Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking
