Open Source Vulnerabilities

zip

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

langgraph-api

LangGraph JavaScript custom authentication may permit cross-user Store access

filelock

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

filelock

filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

filelock

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

filelock

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

filelock

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

filelock

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

filelock

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

filelock

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

filelock

filelock: ReadWriteLock follows a symlink at the lock path into SQLite

filelock

filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses

filelock

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

filelock

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

i18next-http-backend

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

io.opentelemetry:opentelemetry-api

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

knative-eventing-fips-1.24-channel-controller

knative-eventing-fips-1.24-channel-controller

knative-eventing-fips-1.24-channel-controller

knative-eventing-fips-1.24-channel-controller

happy-dom

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

vue-i18n, vue-i18n, @intlify/core, @intlify/core, @intlify/core-base, @intlify/core-base, petite-vue-i18n, petite-vue-i18n, @intlify/vue-i18n-core, @intlify/vue-i18n-core

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

vue-i18n, vue-i18n, vue-i18n, vue-i18n, petite-vue-i18n, petite-vue-i18n, petite-vue-i18n, petite-vue-i18n, @intlify/core-base, @intlify/core-base, @intlify/core-base, @intlify/core-base, @intlify/core, @intlify/core, @intlify/core, @intlify/core, @intlify/vue-i18n-core, @intlify/vue-i18n-core, @intlify/vue-i18n-core, @intlify/vue-i18n-core, @intlify/shared, @intlify/shared, @intlify/shared, @intlify/shared

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

happy-dom

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

langgraph-sdk, langgraph

LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

@graphql-tools/executor-legacy-ws

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

@graphql-tools/executor-legacy-ws

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

@hono/node-server

@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

github.com/labstack/echo/v5, github.com/labstack/echo/v4

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

github.com/labstack/echo/v5, github.com/labstack/echo/v4

Echo static file middleware route protection bypass via encoded dot-dot traversal

github.com/labstack/echo/v5, github.com/labstack/echo/v4

Echo has a Static Middleware Double-Unescape Path Traversal

github.com/labstack/echo/v5, github.com/labstack/echo/v4

Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI

github.com/labstack/echo/v5, github.com/labstack/echo/v4

Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

zod

TuxCare security update for zod (1 CVE)

zod

TuxCare security update for zod (1 CVE)

knative-eventing-1.24-controller

knative-eventing-1.24-controller

knative-eventing-1.24-controller

knative-eventing-1.24-controller

knative-eventing-fips-1.24-channel-dispatcher

knative-eventing-fips-1.24-channel-dispatcher

knative-eventing-fips-1.24-channel-dispatcher

knative-eventing-fips-1.24-channel-dispatcher

knative-eventing-1.24-webhook

knative-eventing-1.24-webhook

knative-eventing-1.24-webhook

knative-eventing-1.24-webhook

LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

knative-eventing-1.24-filter

knative-eventing-1.24-filter