Open Source Vulnerabilities
Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads
Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads
cedar-policy, cedar-policy, @cedar-policy/cedar-wasm, @cedar-policy/cedar-wasm
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
cedar-policy/ cedar-policy/ @cedar-policy/cedar-wasm/ @cedar-policy/cedar-wasm
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
dompurify
TuxCare security update for dompurify (3 CVEs)
@sylphx/pdf-reader-mcp
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
@sylphx/pdf-reader-mcp
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
praisonai
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
praisonai
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
parse-server, parse-server
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
parse-server/ parse-server
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
github.com/daptin/daptin
Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
github.com/daptin/daptin
Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
pocketmine/pocketmine-mp
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
pocketmine/pocketmine-mp
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
dompurify
TuxCare security update for dompurify (3 CVEs)
silverstripe/mfa
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
silverstripe/mfa
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
brotli, brotli, brotli, brotli, brotli, brotli, brotli, brotli, brotli, brotli, brotli, brotli, brotli
Security update for brotli
brotli/ brotli/ brotli/ brotli/ brotli/ brotli/ brotli/ brotli/ brotli/ brotli/ brotli/ brotli/ brotli
Security update for brotli
datadog-cluster-agent-7.78, datadog-cluster-agent-7.78
datadog-cluster-agent-7.78, datadog-cluster-agent-7.78
dompurify
TuxCare security update for dompurify (3 CVEs)
Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant
Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant
flatpak, flatpak, flatpak
Security update for flatpak
Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure
Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure
org.springframework.cloud:spring-cloud-stream
TuxCare security update for org.springframework.cloud:spring-cloud-stream (4 CVEs)
org.springframework.cloud:spring-cloud-stream
TuxCare security update for org.springframework.cloud:spring-cloud-stream (4 CVEs)
SD JWT JS: Tampered disclosures silently dropped instead of rejected
SD JWT JS: Tampered disclosures silently dropped instead of rejected
send
TuxCare security update for send (1 CVE)
imagemagick, imagemagick, imagemagick
keepassxc, keepassxc, keepassxc
imagemagick, imagemagick, imagemagick, imagemagick, imagemagick, imagemagick, imagemagick, imagemagick
imagemagick/ imagemagick/ imagemagick/ imagemagick/ imagemagick/ imagemagick/ imagemagick/ imagemagick
rust-wasmtime, rust-wasmtime, rust-wasmtime
rust-wasmtime, rust-wasmtime, rust-wasmtime
keepassxc, keepassxc, keepassxc, keepassxc, keepassxc, keepassxc
keepassxc/ keepassxc/ keepassxc/ keepassxc/ keepassxc/ keepassxc
rust-wasmtime, rust-wasmtime, rust-wasmtime
rust-wasmtime, rust-wasmtime, rust-wasmtime
rust-wasmtime, rust-wasmtime, rust-wasmtime
