38,567 results · Feed
-
High 8.5
Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only t…
-
High 8.2
Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and p…
-
High 7.0
zizmor: Debug logging prints available GitHub credentials in cleartext
zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHU…
-
Medium 5.3
ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header
ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An…
-
Medium 6.9
OmniAuth: Host Header Injection Vulnerability
OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured.…
-
Medium 6.3
Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cau…
-
High 7.5
Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read
Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file…
-
Medium 6.5
Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. From 1.0.0 until 1.16.2, Remark42 globally trusts True-Client-IP, X-Real-IP, and X-Forwarded-For without verifying that the direct peer is a trust…
-
High 7.7
Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidc_service.go accepts the client-controlled resource parameter and embeds…
-
Medium 6.9
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the fir…
-
High 8.7
tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/…
-
Medium 5.9
JSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoS
JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion …
-
High 7.5
tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request…
-
High 7.5
ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)
ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore pas…
-
Medium 6.9
zt-zip: ZipUtil.unpack can change file permissions of output directory
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directo…
-
High 7.3
traQ: Privilege escalation by OAuth prompt=none request
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all sc…
-
High 7.3
traQ: XSS in the User Uploaded File Retrieval API
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An …
-
Medium 5.3
isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkou…
-
Medium 4.3
isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbol…
-
High 8.8
isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first pl…
-
Critical 9.3
fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacke…
-
Critical 9.3
fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escapin…
-
Critical 9.3
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-cont…
-
Medium 6.1
zt-zip: Path traversal in fluent API unpack
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly…
-
High 8.2
Logging Redactor: PII data in str/repr of non primitive objects was not being redacted
Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when suc…
-
Medium 5.3
AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail. AshAi.ToToolError gained an i…
-
Unscored —
`electrumd` was removed from crates.io for malicious code
`electrumd` attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 5 versions published on 2026-01-26, approximately 10 months before removal, and had no evidence of actual usage. This crate had no dependencies on …
-
Unscored —
`gabby-types-sec` was removed from crates.io for malicious code
`gabby-types-sec` attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 version published on 2026-02-17, approximately 9 months before removal, and had no evidence of actual usage. This crate had no dependencies…
-
Unscored —
`env-test-guard` was removed from crates.io for malicious code
`env-test-guard` attempted to exfiltrate credentials from the environment to an arbitrary URL. The malicious crate had 2 versions published on 2026-03-24 and 2026-03-25, approximately 8 months before removal, and had no evidence of actual usage. This crate ha…
-
Unscored —
`webhook_commands` was removed from crates.io for malicious code
`webhook_commands` attempted to send telemetry from the execution environment to an arbitrary URL. The malicious crate had 1 version published on 2026-02-13, approximately 9 months before removal, and had no evidence of actual usage. This crate had no depende…
-
High 8.2
Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body. The streaming read c…
-
Critical 9.9
LXD has restricted project bypass leading to arbitrary command execution
Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv ### Summary Instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks…
-
High 7.7
LXD has project restriction bypass for custom volume copy across projects
Reported from https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f ### Summary Missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom…
-
High 7.7
LXD has project restriction bypass in instance copy across projects
Reported from https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg ### Summary Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance i…
-
Medium 6.3
GeoNode has Stored XSS in Documents metadata abstract field
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and…
-
Medium 5.5
GeoNode: Unrestricted File Upload
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged remote user to store an…
-
High 8.8CVE-2026-33050 Public exploit
GeoNode: OS command injection via uploaded file layer name
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute…
-
Medium 6.5
Authenticated Denial of Service via Malicious Backup Tarball in LXD
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that …
-
Critical 9.9
LXD has arbitrary file write on client due to trusted image hash
Reported from https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x ### Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command exe…
-
Critical 9.9
LXD has argument injection in backup compression algorithm leading to AFW and ACE
Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 ### Summary Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write…