Browse CVEs by Ecosystem and Severity

OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)

Decidim has a cross-site scripting vulnerability in the version control page

Heap-based Buffer Overflow in sqlite-vec

HTTP Request Smuggling in ruby webrick

ZITADEL's Service Users Deactivation not Working

ZITADEL's User Grant Deactivation not Working

protobuf-java has potential Denial of Service issue

SOFA Hessian Remote Command Execution (RCE) Vulnerability

Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)

Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)

Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182)

Untrusted Query Object Evaluation in RPC API

XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`

ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

Missing connection timeout in Aardvark-dns

Denial of service in quinn-proto when using `Endpoint::retry()`

XXE in PHPSpreadsheet encoding is returned

Kirby has insufficient permission checks in the language settings

Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies

Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries

REXML denial of service vulnerability

squirrelly Code Injection vulnerability

Russh has an OOM Denial of Service due to allocation of untrusted amount

Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects

Magento OS Command ('OS Command Injection') vulnerability

Magento DOM-based Cross-Site Scripting (XSS) vulnerability

Magento Path Traversal vulnerability

Magento OS Command ('OS Command Injection') vulnerability

Magento Stored Cross-Site Scripting (XSS) vulnerability

Magento does not properly restrict excessive authentication attempts

Microsoft Security Advisory CVE-2024-38168 | .NET Denial of Service Vulnerability

Server-Side Request Forgery in axios

CometVisu Backend for openHAB affected by SSRF/XSS

Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

Jenkins Remoting library arbitrary file read vulnerability

Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm

Studio 42 elFinder vulnerable to Incorrect Access Control

tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

SixLabors ImageSharp Out-of-bounds Write

Woodpecker's custom workspace allow to overwrite plugin entrypoint executable

gix-path can use a fake program files location

Mimekit has vulnerable dependency that can lead to denial of service

Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2024-38081 | .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2024-30105 | .NET Denial of Service Vulnerability

NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilities

OPCFoundation.NetStandard.Opc.Ua.Core buffer-management vulnerability

rejetto HFS vulnerable to OS Command Execution by remote authenticated users