Open Source Vulnerabilities

nfs-subdir-external-provisioner, ollama-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be re...

runc

vulnerability has been found in cilium ebpf up to 0

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, strimzi-kafka-operator, solr, solr, solr, solr, solr, solr

Netty is an asynchronous, event-driven network application framework

prometheus-redis-exporter-fips, cluster-autoscaler-fips, kube-state-metrics, nfs-subdir-external-provisioner, ollama-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips

SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process

awx

airflow-3

Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2

airflow-3

Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing

airflow-3

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework

airflow-3

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework

airflow-3

FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callbac...

airflow-3, airflow-3, airflow-3

In Paramiko through 4

activemq

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and t...

activemq

remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class

gradle, spark-sc213-jdk17-py312, gradle, wso2is, strimzi-kafka-operator, solr, wso2is, activemq

fix released in jackson-core 2

gradle, gradle, wso2is, wso2is, wso2is, wso2is

jsoup is a Java library for working with real-world HTML

wso2is

There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter

minio, rclone, rclone, openbao, yunikorn-k8shim, external-secrets-operator-fips

Security fix for GHSA-pjcq-xvwq-hhpj applied in: minio 0.20250907.161309-r3, rclone 1.72.1-5, rclone 1.73.5-r0, openbao 2.5.4-r1, yunikorn-k8shim 1.8.0-r1, external-secrets-operator-fips 2.4.1-r0

grafana, minio, rclone, openbao, yunikorn-k8shim, opentofu, external-secrets-operator-fips

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP

wso2is, wso2is

In Eclipse Jetty, versions <=9

wso2is

Jetty is a Java based web server and servlet engine

wso2is

In Eclipse Jetty versions 9

wso2is

improper authentication vulnerability exists in WSO2 Identity Server 7

wso2is

reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request

wso2is

Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack

wso2is

In Spring Framework versions 5

wso2is

Applications that use UriComponentsBuilder to parse an externally provided URL (e

spark-sc213-jdk17-py312, apache-hive, apache-nifi

JLine is a Java library for handling console input

wso2is

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e

wso2is

Applications that use UriComponentsBuilder to parse an externally provided URL (e

argo-workflows, argo-workflows, renovate, langfuse-worker

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs

wso2is, wso2is, wso2is

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat

wso2is, wso2is, wso2is, wso2is

Improper Access Control vulnerability in Apache Commons

wso2is, wso2is, wso2is, wso2is

vulnerability was found in ESAPI esapi-java-legacy and classified as problematic

wso2is, wso2is, wso2is, wso2is, wso2is

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of serv...

wso2is, wso2is, wso2is, wso2is

Security fix for GHSA-r68h-jhhj-9jvm applied in: wso2is 7.1.0-r1, wso2is 7.2.0-r1, wso2is 7.3.0-r1, wso2is 7.0.0-r1

wildfly, wildfly, wso2is, wso2is, wso2is, wso2is, wso2is

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity r...

sonarqube, spark-sc213-jdk17-py312, wso2is, solr, wso2is

Socket Appender in Apache Log4j Core versions 2

wso2is

SSRF vulnerability in WADL service description in versions of Apache CXF before 4

gradle, spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, apache-hive, elasticsearch, elasticsearch, gradle, wso2is, wso2is, solr, wso2is, wso2is

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

wso2is

SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4

wso2is, wso2is, wso2is

Apache CXF stores large stream based messages as temporary files on the local filesystem

wso2is

There exists a security vulnerability in Jetty's ThreadLimitHandler

wso2is, wso2is, wso2is

potential denial of service vulnerability is present in versions of Apache CXF before 3

wso2is

In Bouncy Castle for Java from 1

wso2is

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc

wso2is

issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1

wso2is

issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1

wso2is

issue was discovered in Bouncy Castle Java Cryptography APIs before 1

wso2is

issue was discovered in ECCurve

sonarqube, apache-hive, spark-sc213-jdk17-py312, apache-hive, apache-hive, apache-hive

yawkat LZ4 Java provides LZ4 compression for Java