GitHub Security Advisories

Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin

Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex...

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection...

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection...

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring...

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed...

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent...

A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL...

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

A stack-based out-of-bounds write vulnerability exists in the login request handling...

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of  TL...

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix...

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection...

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts...

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom...

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's...

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to...

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows...

In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from...

The Brushfire platform's video content streaming application (https://online.brushfire.com)...

Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing...

to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which...

DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth...

A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows...

is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent...

Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect...

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo <...

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2...

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5...

A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior...

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped...

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus...

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as...

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery...

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows...

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between...

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a...

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url...

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow...

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The...

The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit...

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against...

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths...

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and...

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires...

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment...

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative...

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored...

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile...

The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a...

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square...

Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory...

Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated...

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync...

A parser state isolation vulnerability in misp-stix could cause data from a previously processed...

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or...

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the...

A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file...

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall...

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled...

Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to...

A path traversal vulnerability existed in the handling of MISP object template names during STIX...

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is...

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability...

Improper access control in CloudStack's annotation functionality allows unauthorized comment...

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive...

Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0...

Improper authorization for CRUD operations on Project Roles and Project Role permissions for...

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin,...

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability...

Missing authorization issue for domain admins in CloudStack's host tags listing functionality. ...

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's...