38,678 results · Feed
-
Low 3.6
zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash
A vulnerability was detected in zilliztech GPTCache up to 0.1.44. Affected by this issue is the function BufferedReader.peek of the file gptcache/processor/pre.py of the component Cache Key Handler. Performing a manipulation of the argument input_data["image"…
-
High 7.5
React Router vulnerable to Denial of Service via reflected user input in single-fetch
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects co…
-
High 8.3
Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass O…
-
High 7.6
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /de…
-
Medium 4.9
matrix-sdk-ui: Incomplete edit validation
matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matrix-sdk-ui` crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be en…
-
Medium 6.9
Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution
matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the user ID when decrypti…
-
Medium 5.3
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static a…
-
Medium 5.3
Strawberry GraphQL has a Circular Fragment Reference DOS
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragm…
-
Medium 6.3
Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token withou…
-
Medium 6.1
WebOb: Location header normalization during redirect leads to open redirect
WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Py…
-
High 7.5
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard…
-
High 7.5
Axios: Allocation of Resources Without Limits or Throttling in axios
Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or r…
-
High 8.2
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usa…
-
High 7.5
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may ad…
-
Medium 6.5
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuil…
KEV Sep 2, 2026 -
Low 3.6
MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash
A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This manipulation causes use of weak hash. It is possible to launch the…
-
Medium 4.3
keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption
A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumpti…
-
Low 3.6
Streamlit Palette hashing.py weak hash
A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approa…
-
Low 3.6
modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash
A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template._save_pil_image of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An a…
-
Unscored —
tide is unmaintained
The tide crate is unmaintained, and all versions are affected. The closest maintained alternative might be [trillium](https://crates.io/crates/trillium). See [this issue](https://github.com/http-rs/tide/issues/922) for more context.
-
Unscored —
surf is unmaintained
The surf crate is unmaintained, and all versions are affected. For alternatives, consider using [reqwest](https://crates.io/crates/reqwest) or [ureq](https://crates.io/crates/ureq). See [this issue](https://github.com/http-rs/surf/issues/352) for more context.
-
Unscored —
`pqcrypto-hqc` is unmaintained: upstream PQClean project being archived
This crate provides Rust bindings to the HQC key encapsulation mechanism via C implementations from [PQClean](https://github.com/PQClean/PQClean). The PQClean project is being archived in or after July 2026 (see [PQClean/PQClean#604](https://github.com/PQClea…
-
Unscored —
`pqcrypto-classicmceliece` is unmaintained: upstream PQClean project being archived
This crate provides Rust bindings to the Classic McEliece key encapsulation mechanism via C implementations from [PQClean](https://github.com/PQClean/PQClean). The PQClean project is being archived in or after July 2026 (see [PQClean/PQClean#604](https://gith…
-
Unscored —
`pqcrypto-mldsa` is unmaintained: upstream PQClean project being archived
This crate provides Rust bindings to ML-DSA (FIPS 204) via C implementations from [PQClean](https://github.com/PQClean/PQClean). The PQClean project is being archived in or after July 2026 (see [PQClean/PQClean#604](https://github.com/PQClean/PQClean/issues/6…
-
Unscored —
`pqcrypto-falcon` is unmaintained: upstream PQClean project being archived
This crate provides Rust bindings to the Falcon (FN-DSA) signature scheme via C implementations from [PQClean](https://github.com/PQClean/PQClean). The PQClean project is being archived in or after July 2026 (see [PQClean/PQClean#604](https://github.com/PQCle…
-
Unscored —
`pqcrypto` is unmaintained: upstream PQClean project being archived
The `pqcrypto` crate and the entire `pqcrypto-*` ecosystem wrap C implementations from [PQClean](https://github.com/PQClean/PQClean). The PQClean project is being archived in or after July 2026 (see [PQClean/PQClean#604](https://github.com/PQClean/PQClean/iss…
-
Unscored —
`pqcrypto-internals` is unmaintained: upstream PQClean project being archived
This crate provides internal FFI utilities for the `pqcrypto-*` ecosystem, directly wrapping C implementations from [PQClean](https://github.com/PQClean/PQClean). The PQClean project is being archived in or after July 2026 (see [PQClean/PQClean#604](https://g…
-
Unscored —
`pqcrypto-traits` is unmaintained: upstream PQClean project being archived
This crate provides shared trait definitions for the `pqcrypto-*` ecosystem, which wraps C implementations from [PQClean](https://github.com/PQClean/PQClean). The PQClean project is being archived in or after July 2026 (see [PQClean/PQClean#604](https://githu…
-
Unscored —
`pqcrypto-mlkem` is unmaintained: upstream PQClean project being archived
This crate provides Rust bindings to ML-KEM (FIPS 203) via C implementations from [PQClean](https://github.com/PQClean/PQClean). The PQClean project is being archived in or after July 2026 (see [PQClean/PQClean#604](https://github.com/PQClean/PQClean/issues/6…
-
Unscored —
`pqcrypto-sphincsplus` is unmaintained: upstream PQClean project being archived
This crate provides Rust bindings to SPHINCS+/SLH-DSA (FIPS 205) via C implementations from [PQClean](https://github.com/PQClean/PQClean). The PQClean project is being archived in or after July 2026 (see [PQClean/PQClean#604](https://github.com/PQClean/PQClea…
-
Medium 5.9
OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.
-
Critical 9.9
OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
-
Medium 5.8
OpenStack Ironic allows Boot Script Injection
OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.
-
Low 3.6
sgl-project SGLang Cache data_hash denial of service
A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree …
-
Low 2.5
gradio-app gradio Audio Cache Key save_audio_to_cache weak hash
A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position.…
-
High 8.1
Froxlor: API Authentication bypasses 2FA Authentication
Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type_2fa,…
-
High 8.8
BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler
BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes …
-
Medium 6.5
BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler
BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound…
-
Critical 10.0
Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubern…
-
Critical 10.0
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, prior to 3.3.0, the environment variables (KERNEL_XXX) used during the rendering o…