Browse CVEs by Ecosystem and Severity

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

TYPO3 CMS has Insecure Deserialization via Core API

Russh: Unchecked keyboard-interactive prompt count in client auth path

netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access

SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

Net::IMAP: Command Injection via ID command argument

Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument

Spree: CSV Formula Injection in Customer Export

Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret

rattler has an entry-point path traversal in noarch:python install (arbitrary file write)

unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race

nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

ImageMagick: Heap Buffer Over-Read in distributed pixel cache server

ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model

ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking

ImageMagick: Heap Buffer Over-Write in distributed pixel cache server

ImageMagick: Heap Buffer Over-Write in json and yaml encoder of a single byte due to incorrect fix

Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

nimiq-primitives: BlockInclusionProof interlink issue when hops are empty

OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle

n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass

ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.

ImageMagick: Stack overflow in fx operation

ImageMagick: Use-After-Free in MSL decoder.

ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

ImageMagick: Policy Bypass in MNG coder could

ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

ImageMagick: Policy Bypass in PSD decoder

ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

Microsoft DirectX12: .spritefont multiply overflow only in 32-bit builds

Microsoft DirectX: .spritefont multiply overflow only in 32-bit builds

ImageMagick: Heap Buffer Over-Read in IPTC encoder

Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

SharpCompress has directory traversal via directory entries in WriteToDirectory (zip slip variant)

view_component: System Test Entry Point Path Check Allows Sibling Directory Escape

view_component: Preview Route Can Dispatch Inherited Helper Methods

OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured

Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler

Zebra Vulnerable to Allocation Amplification in Inbound Network Deserializers

Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL

CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content

misp-modules has nsafe remote resource fetching in expansion