Advisory Catalog

Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

Nautobot vulnerable to exposure of hashed user passwords via REST API

Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload

Langchain Server-Side Request Forgery vulnerability

PDM Trojan Lockfile

modoboa Cross-site Scripting vulnerability

modoboa Cross-Site Request Forgery vulnerability

mycli has Inadequate Encryption Strength

Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context

LangChain Server Side Request Forgery vulnerability

TorBot vulnerable to Inefficient Regular Expression Complexity in validate_link

NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0.

Pickle serialization vulnerable to Deserialization of Untrusted Data

OctoPrint vulnerable to Improper Neutralization of Special Elements Used in a Template Engine

Bundled libwebp in pywebp vulnerable

NI MeasurementLink Python Services Improper Access Restriction vulnerability

Bundled libwebp in imagecodecs vulnerable

Ansible may expose private key

asyncua Improper Authentication vulnerability

asyncua vulnerable to denial of service via infinite loop

opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics

`Cookie` HTTP header isn't stripped on cross-origin redirects

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro

Rdiffweb Allocation of Resources Without Limits or Throttling vulnerability

pretix allows Pillow to parse EPS files

Vyper's `_abi_decode` input not validated in complex expressions

yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`

OpenStack Heat information leak vulnerability

pgAdmin failed to properly control the server code

Withdrawn Advisory: Mobile Security Framework (MobSF) Vulnerable to Insecure Permissions

plone.rest vulnerable to Denial of Service when ++api++ is used many times

Vyper vulnerable to memory corruption in certain builtins utilizing `msize`

GeoNode vulnerable to SSRF Bypass to return internal host data

Apache HDFS Provider error message suggested

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

libwebp: OOB write in BuildHuffmanTable

Apache Airflow information exposure vulnerability

Remote Code Execution in Custom Integration Upload

Information disclosure in AccessControl

Salt can cause Git Providers to get wrong data

Sandbox escape via various forms of "format".

GitPython untrusted search path on Windows systems leading to arbitrary code execution

Airflow Sqoop Provider RCE Vulnerability

Apache Airflow vulnerable arbitrary code execution via Spark server

Keylime registrar and (untrusted) Agent can be bypassed by an attacker

GeoNode Server Side Request forgery

Apache Airflow denial of service vulnerability

Apache Airflow Session Fixation vulnerability

json2xml Uncaught Exception vulnerability

Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other unspecified impacts via use of crafted file.