Vulnerabilities
Last updated 1 hour ago
| Package | Summary | Severity | Published | Modified |
|---|---|---|---|---|
assent
|
Unverified Sign in with Apple callback parameter can override verified ID token claims | Unknown | 1 hour ago | 1 hour ago |
pypdf
|
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search | High Risk 8.0 | 2 hours ago | 1 hour ago |
github.com/kubeflow/pipelines
|
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory | High Risk 7.5 | 2 hours ago | 1 hour ago |
|
pypdf
|
pypdf has possible large memory usage when parsing page tree | High Risk 8.0 | 2 hours ago | 1 hour ago |
|
pypdf
|
pypdf has possible infinite loop when cloning dictionaries | High Risk 8.0 | 2 hours ago | 1 hour ago |
|
github.com/kubeflow/pipelines
|
Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs | High Risk 7.5 | 2 hours ago | 1 hour ago |
@signalk/resources-provider
|
Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution | Critical 9.8 | 2 hours ago | 2 hours ago |
|
signalk-server
|
Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution | Critical 9.8 | 2 hours ago | 2 hours ago |
|
node-forge
|
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 | High Risk 7.4 | 2 hours ago | 2 hours ago |
|
@nuxt/vite-builder
|
Nuxt dev server exposes private runtime config through the Nitro dev bundle | Medium Risk 5.9 | 2 hours ago | 2 hours ago |
pageant
|
pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) | Low Risk 3.0 | 2 hours ago | 2 hours ago |
|
oauthlib
|
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client | High Risk 8.0 | 2 hours ago | 2 hours ago |
|
node-forge
|
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message | High Risk 7.5 | 2 hours ago | 2 hours ago |
|
openwisp-controller
|
OpenWISP Controller CA CRL REST API does not scope requests to managed organizations | Medium Risk 6.0 | 2 hours ago | 2 hours ago |
|
authlib
|
Authlib RFC 7592 examples omit registration-access-token client binding | High Risk 8.8 | 2 hours ago | 2 hours ago |
org.mariadb.jdbc:mariadb-java-client
|
MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing | Medium Risk 5.9 | 2 hours ago | 2 hours ago |
|
@sigstore/oci
|
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location | High Risk 7.4 | 2 hours ago | 2 hours ago |
|
russh
|
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation | High Risk 8.0 | 2 hours ago | 2 hours ago |
|
@hapi/joi
|
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service | High Risk 7.5 | 2 hours ago | 2 hours ago |
|
joi
|
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service | High Risk 7.5 | 2 hours ago | 2 hours ago |
|
russh
|
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets | Medium Risk 4.3 | 2 hours ago | 2 hours ago |
|
pypdf
|
pypdf has possible large memory usage for exceptions in strict mode | High Risk 8.0 | 2 hours ago | 2 hours ago |
|
node-forge
|
Forge: Regular expression denial of service in PEM decoding (pem.decode) | High Risk 7.5 | 2 hours ago | 2 hours ago |
|
pyasn1
|
pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding | High Risk 7.5 | 2 hours ago | 2 hours ago |
|
nuxt
|
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes | Medium Risk 6.5 | 2 hours ago | 2 hours ago |
|
@nuxt/nitro-server
|
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes | Medium Risk 6.5 | 2 hours ago | 2 hours ago |
|
russh
|
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages | Low Risk 3.3 | 2 hours ago | 2 hours ago |
|
minimatch
|
minimatch has potential denial of service via globparts amplification | Medium Risk 6.0 | 2 hours ago | 2 hours ago |
|
github.com/imgproxy/imgproxy
|
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution | Critical 9.8 | 2 hours ago | 2 hours ago |
|
github.com/imgproxy/imgproxy/v2
|
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution | Critical 9.8 | 2 hours ago | 2 hours ago |
|
github.com/imgproxy/imgproxy/v3
|
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution | Critical 9.8 | 2 hours ago | 2 hours ago |
|
node-forge
|
Forge: Denial of service in TLS record processing via call stack exhaustion | High Risk 7.5 | 2 hours ago | 2 hours ago |
|
github.com/imgproxy/imgproxy/v3
|
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash | High Risk 7.5 | 2 hours ago | 2 hours ago |
|
node-forge
|
Forge: TLS client crash when the server sends no certificate | Medium Risk 5.9 | 2 hours ago | 2 hours ago |
|
signalk-server
|
signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher | Medium Risk 4.2 | 2 hours ago | 2 hours ago |
|
org.mariadb.jdbc:mariadb-java-client
|
MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files | Medium Risk 5.9 | 2 hours ago | 2 hours ago |
|
pyasn1
|
pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding | High Risk 7.5 | 2 hours ago | 2 hours ago |
|
org.mariadb.jdbc:mariadb-java-client
|
MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets | Medium Risk 5.9 | 2 hours ago | 2 hours ago |
|
pyasn1
|
pyasn1 has quadratic-complexity denial of service in binary REAL decoding | High Risk 7.5 | 2 hours ago | 2 hours ago |
|
github.com/imgproxy/imgproxy/v3
|
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field | High Risk 7.5 | 2 hours ago | 2 hours ago |
|
graphql-core
|
GraphQL-core has denial of service via memory leak in aborted validations | High Risk 7.5 | 2 hours ago | 2 hours ago |
|
follow-redirects
|
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects | Medium Risk 5.9 | 2 hours ago | 2 hours ago |
|
pypdf
|
pypdf has possible long runtimes when retrieving page labels | High Risk 8.0 | 2 hours ago | 2 hours ago |
|
node-forge
|
Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store | Low Risk 3.7 | 2 hours ago | 2 hours ago |
|
org.mariadb.jdbc:mariadb-java-client
|
MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths | Low Risk 3.7 | 2 hours ago | 2 hours ago |
|
node-forge
|
Forge: AES-GCM authentication bypass via unvalidated tagLength option | Medium Risk 5.9 | 2 hours ago | 2 hours ago |
|
pypdf
|
pypdf has possible long runtimes/large memory usage for encrypted PDF files | High Risk 8.0 | 2 hours ago | 2 hours ago |
|
node-forge
|
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie | Medium Risk 4.8 | 2 hours ago | 2 hours ago |
|
org.mariadb.jdbc:mariadb-java-client
|
MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths | Medium Risk 5.9 | 2 hours ago | 2 hours ago |
phpunit/phpunit
|
PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling | Medium Risk 6.0 | 2 hours ago | 2 hours ago |
Page 1