Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicio…
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm …
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a sha…
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Ca…
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-base…
The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders a documentation URL part (formatPartURL in Docume…
Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base: from n/a thro…
A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should…
temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier…
ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH …
Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host gram…
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as …
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-head…
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy re…
Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocomme…
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON S…
### Summary Terragrunt's `terragrunt catalog` command clones each repository referenced in your catalog configuration into a temporary working directory. In affected versions, the clone path it deri…
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The …
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natu…