Open Source Vulnerabilities

body-parser

TuxCare security update for body-parser (1 CVE)

Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state

body-parser

TuxCare security update for body-parser (1 CVE)

qemu

qemu

qemu

qemu

traefik-3.6, traefik-3.6

minimatch: potential denial of service via globparts amplification

dotnet8, dotnet10, dotnet8, dotnet10, dotnet11, dotnet10

dotnet8, dotnet10, dotnet11 vulnerabilities

@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

SixLabors.ImageSharp

Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)

dotnet8-runtime, dotnet8-runtime

decode-uri-component

decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

twisted

Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

zip

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

zip

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

zip

zip: AES Entry HMAC Authentication Bypass on Premature EOF

zip

zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

vite

Vite: `server.fs.deny` bypassed with queries

shopify_app

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

github.com/cert-manager/cert-manager, github.com/cert-manager/cert-manager

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

neo4j-fips-5.26

neo4j-fips-5.26

neo4j-fips-5.26

neo4j-fips-5.26

kube-startup-cpu-boost-fips

kube-startup-cpu-boost-fips

org.keycloak:keycloak-services

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0

org.keycloak:keycloak-services

Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

kube-startup-cpu-boost

kube-startup-cpu-boost

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

org.keycloak:keycloak-services

Keycloak allows unauthorized access to resources via uma permission ticket bypass

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

org.keycloak:keycloak-services, org.keycloak:keycloak-policy-enforcer

Keycloak vulnerable to authorization bypass via incorrect uri comparison

Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes

renovate, renovate

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

org.keycloak:keycloak-services

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

@eeacms/volto-chatbot

@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy

crass

Crass: Non-ASCII characters cause superlinear CPU consumption

crass

Crass: A large number of adjacent CSS comments can trigger a SystemStackError

crass

Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage