Vulnerability-Lookup

GHSA-Q5FM-55C2-V6J9

Vulnerability from github – Published: 2024-07-16 19:32 – Updated: 2024-08-21 22:30

Summary

Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib

Details

Summary

Vulnerability scan of fiona shows CVE-2023-45853. The vulnerability is in GDAL, a dependency of fiona.

Details

Fiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. The GDAL project has addressed the CVE in version 3.8.0. See https://lists.osgeo.org/pipermail/gdal-dev/2023-November/057881.html.

The Fiona version 1.9.6 wheels on PyPI include GDAL version 3.6.4 and thus could be vulnerable. All of the Fiona 1.10 pre-release wheels in PyPI include GDAL version 3.8.4 and are not vulnerable.

Impact

Systems which use GDAL versions prior to 3.8.0 to open unchecked zip files, whether in combination with fiona or not, could be susceptible to buffer overflows.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "fiona"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10b1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-16T19:32:45Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\nVulnerability scan of fiona shows [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853). The vulnerability is in GDAL, a dependency of fiona.\n\n### Details\nFiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. The GDAL project has addressed the CVE in version 3.8.0. See https://lists.osgeo.org/pipermail/gdal-dev/2023-November/057881.html.\n\nThe Fiona version 1.9.6 wheels on PyPI include GDAL version 3.6.4 and thus could be vulnerable. All of the Fiona 1.10 pre-release wheels in PyPI include GDAL version 3.8.4 and are not vulnerable.\n\n### Impact\nSystems which use GDAL versions prior to 3.8.0 to open unchecked zip files, whether in combination with fiona or not, could be susceptible to buffer overflows.",
  "id": "GHSA-q5fm-55c2-v6j9",
  "modified": "2024-08-21T22:30:04Z",
  "published": "2024-07-16T19:32:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Toblerity/Fiona/security/advisories/GHSA-q5fm-55c2-v6j9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45853"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OSGeo/gdal/commit/4aa7ca61c1d2191baf1eea2a97d0dec33a41691f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Toblerity/Fiona"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib"
}

GHSA-Q7J3-V8QV-22VQ

Vulnerability from github – Published: 2026-06-19 16:35 – Updated: 2026-06-19 16:35

Summary

OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL

Details

Impact

Possible data exposure.

Summary

While downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read. This might allow disclosure of confidential information.

Details

OpenTofu relies on go-getter for downloading packages like providers and modules. While doing so from a maliciously crafted URL, the operator could be affected by confidential information disclosure.

The go-getter maintainers have recently published CVE-2026-4660 for this library which indirectly affects OpenTofu's behavior.

Typical use of OpenTofu already requires caution in selection of URLs that are used to download modules and providers.

Patches

OpenTofu v1.11.10 and v1.12.3 address these vulnerabilities by upgrading to the hashicorp/go-getter@v1.8.6 that fixes this vulnerability.

The OpenTofu v1.10 series is also impacted by these vulnerabilities. However, that series is built with an older version of the library and upgrading it risks breaking the whole v1.10 series. For those using OpenTofu v1.10 releases, we recommend planning an upgrade to OpenTofu v1.11.10 in the near future.

References

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/opentofu/opentofu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/opentofu/opentofu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.12.0-beta1"
            },
            {
              "fixed": "1.12.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T16:35:09Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nPossible data exposure.\n#### Summary\nWhile downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read.\nThis might allow disclosure of confidential information.\n\n#### Details\nOpenTofu relies on [go-getter](https://github.com/hashicorp/go-getter) for downloading packages like providers and modules. While doing so from a maliciously crafted URL, the operator could be affected by confidential information disclosure. \n\nThe go-getter maintainers have recently published [CVE-2026-4660](https://github.com/advisories/GHSA-92mm-2pjq-r785) for this library which indirectly affects OpenTofu\u0027s behavior.\n\nTypical use of OpenTofu already requires caution in selection of URLs that are used to download modules and providers.\n\n### Patches\nOpenTofu v1.11.10 and v1.12.3 address these vulnerabilities by upgrading to the [hashicorp/go-getter@v1.8.6](https://github.com/hashicorp/go-getter/releases/tag/v1.8.6) that fixes this vulnerability.\n\nThe OpenTofu v1.10 series is also impacted by these vulnerabilities. However, that series is built with an older version of the library and upgrading it risks breaking the whole v1.10 series. \nFor those using OpenTofu v1.10 releases, we recommend planning an upgrade to OpenTofu v1.11.10 in the near future.\n\n### References\n* [Initial report](https://github.com/opentofu/opentofu/pull/4288)\n* [CVE-2026-4660](https://github.com/advisories/GHSA-92mm-2pjq-r785)\n* [OpenTofu v1.12 patch](https://github.com/opentofu/opentofu/pull/4293)\n* [OpenTofu v1.11 patch](https://github.com/opentofu/opentofu/pull/4292)\n* [Patched v1.12.3 version](https://github.com/opentofu/opentofu/releases/tag/v1.12.3)\n* [Patched v1.11.10 version](https://github.com/opentofu/opentofu/releases/tag/v1.11.10)",
  "id": "GHSA-q7j3-v8qv-22vq",
  "modified": "2026-06-19T16:35:10Z",
  "published": "2026-06-19T16:35:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opentofu/opentofu/pull/4288"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opentofu/opentofu/pull/4292"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opentofu/opentofu/pull/4293"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-92mm-2pjq-r785"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hashicorp/go-getter/releases/tag/v1.8.6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opentofu/opentofu"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opentofu/opentofu/releases/tag/v1.11.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opentofu/opentofu/releases/tag/v1.12.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL"
}

GHSA-R92C-9C7F-3PJ8

Vulnerability from github – Published: 2026-01-21 22:58 – Updated: 2026-02-03 20:24

Summary

OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format

Details

Impact

Unauthenticated denial of service.

Summary

When installing module packages from attacker-controlled sources, tofu init may cause high CPU usage when encountering maliciously-crafted .zip archives for either provider or module distribution packages.

Those who depend on modules or providers served from untrusted third-party servers may experience denial of service due to tofu init failing to complete in a timely manner. Other processes running on the same computer as OpenTofu may also have their performance degraded due to the high CPU usage.

These vulnerabilities do not permit arbitrary code execution or allow disclosure of confidential information.

Details

OpenTofu relies on a third-party implementation of .zip archive extraction from the standard library of the Go programming language. The Go project has recently published a minor release (Go 1.25.6) to address a problem of potential excessive CPU usage when accessing files in a maliciously-crafted .zip archive.

OpenTofu's threat model considers module and package dependencies to be arbitrary third-party code that operators must carefully review after installation. However, this particular problem affects the process of installing these dependencies with tofu init, and so can potentially occur before an operator has had the opportunity to review what is being installed.

An attacker can exploit this by controlling the content of a package served when OpenTofu is expecting to receive a archive using the .zip format, during either provider or module package installation.

However, the attacker must also coerce an OpenTofu operator into attempting dependency installation from a source that they control. Typical use of OpenTofu already requires caution in selection of third-party dependencies because they are arbitrary code, and so the vulnerability here is only in the addition of a potential denial of service in the tofu init process, which does not execute third-party dependency code itself.

Patches

OpenTofu v1.11.4 addresses these vulnerabilities by being built against Go 1.25.6, which contains an improved version of the upstream implementation.

Workarounds

These vulnerabilities can be exploited only if an attacker can coerce an operator to add a dependency from an attacker-controlled source to their configuration before running tofu init. Those who are unable to immediately upgrade can therefore minimize risk by reviewing new dependencies before adding them to the configuration, such as by directly fetching the relevant artifacts using software other than OpenTofu.

Successful exploitation requires that the attacker control a .zip archive that OpenTofu would fetch and extract during the provider or module installation processes. Note that OpenTofu modules can have their own dependencies on other providers and modules, so an attacker could potentially use a module served from a source such as GitHub or the OpenTofu Registry to indirectly request a provider or module package from a server that they control.

References

Severity

3.1 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/opentofu/opentofu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-21T22:58:42Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Impact\nUnauthenticated denial of service.\n\n### Summary\nWhen installing module packages from attacker-controlled sources, `tofu init` may cause high CPU usage when encountering maliciously-crafted `.zip` archives for either provider or module distribution packages.\n\nThose who depend on modules or providers served from untrusted third-party servers may experience denial of service due to `tofu init` failing to complete in a timely manner. Other processes running on the same computer as OpenTofu may also have their performance degraded due to the high CPU usage.\n\nThese vulnerabilities **do not** permit arbitrary code execution or allow disclosure of confidential information.\n\n### Details\n\nOpenTofu relies on a third-party implementation of `.zip` archive extraction from the standard library of the Go programming language. The Go project has recently published a minor release (Go 1.25.6) to address a problem of potential excessive CPU usage when accessing files in a maliciously-crafted `.zip` archive.\n\nOpenTofu\u0027s threat model considers module and package dependencies to be arbitrary third-party code that operators must carefully review after installation. However, this particular problem affects the process of installing these dependencies with `tofu init`, and so can potentially occur before an operator has had the opportunity to review what is being installed.\n\nAn attacker can exploit this by controlling the content of a package served when OpenTofu is expecting to receive a archive using the `.zip` format, during either provider or module package installation.\n\nHowever, the attacker must also coerce an OpenTofu operator into attempting dependency installation from a source that they control. Typical use of OpenTofu already requires caution in selection of third-party dependencies because they are arbitrary code, and so the vulnerability here is only in the addition of a potential denial of service in the `tofu init` process, which does not execute third-party dependency code itself.\n\n### Patches\n\nOpenTofu v1.11.4 addresses these vulnerabilities by being built against Go 1.25.6, which contains an improved version of the upstream implementation.\n\n### Workarounds\n\nThese vulnerabilities can be exploited only if an attacker can coerce an operator to add a dependency from an attacker-controlled source to their configuration before running `tofu init`. Those who are unable to immediately upgrade can therefore minimize risk by reviewing new dependencies before adding them to the configuration, such as by directly fetching the relevant artifacts using software other than OpenTofu.\n\nSuccessful exploitation requires that the attacker control a `.zip` archive that OpenTofu would fetch and extract during the provider or module installation processes. Note that OpenTofu modules can have their own dependencies on other providers and modules, so an attacker could potentially use a module served from a source such as GitHub or the OpenTofu Registry to indirectly request a provider or module package from a server that they control.\n\n### References\n\n- [OpenTofu v1..11.4 release notes](https://github.com/opentofu/opentofu/releases/tag/v1.11.4)\n- [golang/go#77102](https://github.com/golang/go/issues/77102)",
  "id": "GHSA-r92c-9c7f-3pj8",
  "modified": "2026-02-03T20:24:00Z",
  "published": "2026-01-21T22:58:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opentofu/opentofu/security/advisories/GHSA-r92c-9c7f-3pj8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/golang/go/issues/77102"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opentofu/opentofu/pull/3689"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opentofu/opentofu/commit/f5d5cdf16615ea3c298e058b062951adb02805f3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opentofu/opentofu"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opentofu/opentofu/releases/tag/v1.11.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenTofu has High CPU usage in \"tofu init\" with maliciously-crafted module packages in .zip format"
}

GHSA-RRQF-W74J-24FF

Vulnerability from github – Published: 2024-09-04 17:19 – Updated: 2024-09-25 17:55

Summary

Indico has a Cross-Site-Scripting during account creation

Details

Impact

There is a Cross-Site-Scripting vulnerability during account creation when redirecting after the account has been successfully created. Exploitation requires the user to initiate the account creation process with a maliciously crafted link, and then finalize the signup process. Because of this, it can only target newly created (and thus unprivileged) Indico users so the benefits of exploiting it are very limited.

Patches

You should to update to Indico 3.3.4 as soon as possible. See the docs for instructions on how to update.

Workarounds

If you build the Indico package yourself and cannot upgrade for some reason, you can simply update the flask-multipass dependency to >=0.5.5 which fixes the vulnerability. You would do that by editing requirements.txt before building the package (see commit 7dcb573837), or possibly cherry-picking that particular commit.
Otherwise you could configure your web server to disallow requests containing a query string with a parameter that starts with javascript:

For more information

If you have any questions or comments about this advisory:

Open a thread in our forum
Email us privately at indico-team@cern.ch

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "indico"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-45399"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-04T17:19:14Z",
    "nvd_published_at": "2024-09-04T20:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThere is a Cross-Site-Scripting vulnerability during account creation when redirecting after the account has been successfully created.\nExploitation requires the user to initiate the account creation process with a maliciously crafted link, and then finalize the signup process. Because of this, it can only target newly created (and thus unprivileged) Indico users so the benefits of exploiting it are very limited.\n\n### Patches\nYou should to update to [Indico 3.3.4](https://github.com/indico/indico/releases/tag/v3.3.4) as soon as possible.\nSee [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to update.\n\n### Workarounds\n- If you build the Indico package yourself and cannot upgrade for some reason, you can simply update the `flask-multipass` dependency to `\u003e=0.5.5` which fixes the vulnerability. You would do that by editing `requirements.txt` before building the package (see commit 7dcb573837), or possibly cherry-picking that particular commit.\n- Otherwise you could configure your web server to disallow requests containing a query string with a parameter that starts with `javascript:`\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open a thread in [our forum](https://talk.getindico.io/)\n- Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)",
  "id": "GHSA-rrqf-w74j-24ff",
  "modified": "2024-09-25T17:55:29Z",
  "published": "2024-09-04T17:19:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/indico/indico/security/advisories/GHSA-rrqf-w74j-24ff"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45399"
    },
    {
      "type": "WEB",
      "url": "https://github.com/indico/flask-multipass/commit/0bdcf656d469e5f675cb56fd644d82fea3a97c2a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/indico/indico/commit/7dcb573837b9fd09d95f74d1baeae225b164cc8f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/indico/indico"
    },
    {
      "type": "WEB",
      "url": "https://github.com/indico/indico/releases/tag/v3.3.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/indico/PYSEC-2024-90.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Indico has a Cross-Site-Scripting during account creation"
}

GHSA-VJ2P-7PGW-G2WF

Vulnerability from github – Published: 2026-03-27 15:46 – Updated: 2026-03-27 15:46

Summary

Postiz App has a High-Severity SSRF Vulnerability via Next.js

Details

Impact

A successful SSRF attack allows an attacker to: - Bypass firewalls to scan and interact with internal network services/ports. - Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials. - Pivot into the internal network environment where Postiz is hosted.

Workarounds

There are no workarounds known to this, please upgrade to Postiz version v2.21.1.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "postiz"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.0.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-27T15:46:53Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nA successful SSRF attack allows an attacker to:\n- Bypass firewalls to scan and interact with internal network services/ports.\n- Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials.\n- Pivot into the internal network environment where Postiz is hosted.\n\n### Workarounds\nThere are no workarounds known to this, please upgrade to Postiz version `v2.21.1`.",
  "id": "GHSA-vj2p-7pgw-g2wf",
  "modified": "2026-03-27T15:46:53Z",
  "published": "2026-03-27T15:46:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-vj2p-7pgw-g2wf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34351"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gitroomhq/postiz-app"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Postiz App has a High-Severity SSRF Vulnerability via Next.js"
}

GHSA-VJWG-28GV-PM8H

Vulnerability from github – Published: 2024-04-24 17:02 – Updated: 2024-05-08 14:01

Summary

Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881

Details

Impact

The TineMCE Bundle uses tinymce version 6.7.3. CVEs for this version exists for <6.8.1: https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Patches

The package should be updated to at least 6.8.1 to avoid XSS vulnerability.

Workarounds

Upgrade pimcore to release 11.2.3 or 11.1.6.5.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "pimcore/pimcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.2.0"
            },
            {
              "fixed": "11.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "pimcore/pimcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-ALPHA1"
            },
            {
              "fixed": "11.1.6.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-24T17:02:33Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe TineMCE Bundle uses tinymce version 6.7.3. CVEs for this version exists for \u003c6.8.1:\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-29203\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-29881\n\n### Patches\nThe package should be updated to at least 6.8.1 to avoid XSS vulnerability.\n\n### Workarounds\nUpgrade pimcore to release 11.2.3 or 11.1.6.5.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-29203\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-29881\n",
  "id": "GHSA-vjwg-28gv-pm8h",
  "modified": "2024-05-08T14:01:01Z",
  "published": "2024-04-24T17:02:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-vjwg-28gv-pm8h"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pimcore/pimcore"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881"
}

GHSA-VRPV-VW92-328G

Vulnerability from github – Published: 2025-02-06 17:10 – Updated: 2025-02-06 17:10

Summary

Multiple rtmpdump vulnerabilities

Details

The version of rtmpdump contained in this package has multiple known vulnerabilities.

Patches

This package is abandoned and should not be used anymore. There is no patched release.

Workarounds

You should install rmtpdump from another source.

References

https://github.com/advisories/GHSA-fm48-q5qq-894j
https://github.com/advisories/GHSA-pfv7-grcx-8gcc
https://github.com/advisories/GHSA-hg4c-2mw4-gwpm

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "rudloff/rtmpdump-bin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-06T17:10:32Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "The version of rtmpdump contained in this package has multiple known vulnerabilities.\n\n### Patches\nThis package is abandoned and should not be used anymore.\nThere is no patched release.\n\n### Workarounds\nYou should install rmtpdump from another source.\n\n### References\n* https://github.com/advisories/GHSA-fm48-q5qq-894j\n* https://github.com/advisories/GHSA-pfv7-grcx-8gcc\n* https://github.com/advisories/GHSA-hg4c-2mw4-gwpm",
  "id": "GHSA-vrpv-vw92-328g",
  "modified": "2025-02-06T17:10:32Z",
  "published": "2025-02-06T17:10:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Rudloff/rtmpdump-bin/security/advisories/GHSA-vrpv-vw92-328g"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Rudloff/rtmpdump-bin"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-fm48-q5qq-894j"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-hg4c-2mw4-gwpm"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-pfv7-grcx-8gcc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Multiple rtmpdump vulnerabilities"
}

GHSA-VVFQ-8HWR-QM4M

Vulnerability from github – Published: 2025-02-18 22:36 – Updated: 2025-03-10 22:36

Summary

Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

Details

Summary

Nokogiri v1.18.3 upgrades its dependency libxml2 to v2.13.6.

libxml2 v2.13.6 addresses:

CVE-2025-24928
described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
CVE-2024-56171
described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828

Impact

CVE-2025-24928

Stack-buffer overflow is possible when reporting DTD validation errors if the input contains a long (~3kb) QName prefix.

CVE-2024-56171

Use-after-free is possible during validation against untrusted XML Schemas (.xsd) and, potentially, validation of untrusted documents against trusted Schemas if they make use of xsd:keyref in combination with recursively defined types that have additional identity constraints.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "nokogiri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.18.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-121",
      "CWE-1395",
      "CWE-416"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-18T22:36:03Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\nNokogiri v1.18.3 upgrades its dependency libxml2 to [v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).\n\nlibxml2 v2.13.6 addresses:\n\n- CVE-2025-24928\n  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847\n- CVE-2024-56171\n   - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828\n\n## Impact\n\n### CVE-2025-24928\n\nStack-buffer overflow is possible when reporting DTD validation errors if the input contains a long (~3kb) QName prefix.\n\n### CVE-2024-56171\n\nUse-after-free is possible during validation against untrusted XML Schemas (.xsd) and, potentially, validation of untrusted documents against trusted Schemas if they make use of `xsd:keyref` in combination with recursively defined types that have additional identity constraints.",
  "id": "GHSA-vvfq-8hwr-qm4m",
  "modified": "2025-03-10T22:36:22Z",
  "published": "2025-02-18T22:36:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sparklemotion/nokogiri"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171"
}

GHSA-VVG7-8RMQ-92G7

Vulnerability from github – Published: 2025-12-17 20:57 – Updated: 2025-12-17 20:57

Summary

Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency

Details

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Projects are affected if they meet the following preconditions:

Applications using the Auth0 Wordpress plugin with version between 5.0.0-BETA0 and 5.4.0,
Auth0 Wordpress plugin uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0 Wordpress plugin to version 5.5.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.4.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "auth0/wordpress"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-BETA0"
            },
            {
              "fixed": "5.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-17T20:57:09Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Description\nIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.\n\n### Affected product and versions\nProjects are affected if they meet the following preconditions:\n\n- Applications using the Auth0 Wordpress plugin with version between 5.0.0-BETA0 and 5.4.0,\n- Auth0 Wordpress plugin uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.\n\n### Resolution\nUpgrade Auth0 Wordpress plugin to version 5.5.0 or greater.\n\n### Acknowledgement\nOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.",
  "id": "GHSA-vvg7-8rmq-92g7",
  "modified": "2025-12-17T20:57:09Z",
  "published": "2025-12-17T20:57:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/auth0/wordpress/security/advisories/GHSA-vvg7-8rmq-92g7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/auth0/wordpress/commit/b207c6f7fd06507b90c4e6bcc18a857ef9e018de"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/auth0/wordpress"
    },
    {
      "type": "WEB",
      "url": "https://github.com/auth0/wordpress/releases/tag/5.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency"
}

GHSA-W2FM-25VW-VH7F

Vulnerability from github – Published: 2026-04-01 23:58 – Updated: 2026-04-01 23:58

Summary

mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

Details

mcp-handler versions prior to 1.1.0 accepted @modelcontextprotocol/sdk < 1.26.0 as a peer dependency. That SDK version contains a vulnerability [CVE-2026-25536] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a StreamableHTTPServerTransport instance is reused across requests.

Note: This is not a vulnerability in mcp-handler itself. The root cause is in the peer dependency @modelcontextprotocol/sdk.

Impact

A low-privileged attacker making concurrent requests to an mcp-handler endpoint can read another client's session data, including authentication information and tool execution state. This is a confidentiality breach with potential for limited integrity impact.

Root Cause: CVE-2026-25536 in @modelcontextprotocol/sdk < 1.26.0. The SDK did not prevent reuse of stateless transports across client connections.

Patches

Upgrade to mcp-handler@1.1.0. This release raises the minimum peer dependency to @modelcontextprotocol/sdk@>=1.26.0, which contains the fix for CVE-2026-25536.

Workarounds

Upgrade @modelcontextprotocol/sdk to >=1.26.0 (note: the SDK will throw on transport reuse, which will break mcp-handler < 1.1.0 which effectively forces the upgrade)
Alternatively, manually create fresh McpServer and transport instances per request in your handler code

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mcp-handler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T23:58:50Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "`mcp-handler` versions prior to 1.1.0 accepted `@modelcontextprotocol/sdk` \u003c 1.26.0 as a peer dependency. That SDK version contains a vulnerability [[CVE-2026-25536](https://nvd.nist.gov/vuln/detail/CVE-2026-25536)] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a `StreamableHTTPServerTransport` instance is reused across requests.\n\n**Note:** This is _not_ a vulnerability in `mcp-handler` itself. The root cause is in the peer dependency `@modelcontextprotocol/sdk`. \n\n### Impact\n\nA low-privileged attacker making concurrent requests to an `mcp-handler` endpoint can read another client\u0027s session data, including authentication information and tool execution state. This is a confidentiality breach with potential for limited integrity impact.\n\n**Root Cause:** [CVE-2026-25536](https://nvd.nist.gov/vuln/detail/CVE-2026-25536) in `@modelcontextprotocol/sdk` \u003c 1.26.0. The SDK did not prevent reuse of stateless transports across client connections.\n\n### Patches\n\nUpgrade to `mcp-handler@1.1.0`. This release raises the minimum peer dependency to `@modelcontextprotocol/sdk@\u003e=1.26.0`, which contains the fix for CVE-2026-25536. \n\n### Workarounds\n\n- Upgrade `@modelcontextprotocol/sdk` to `\u003e=1.26.0` (note: the SDK will throw on transport reuse, which will break `mcp-handler` \u003c 1.1.0 which effectively forces the upgrade)\n- Alternatively, manually create fresh `McpServer` and transport instances per request in your handler code",
  "id": "GHSA-w2fm-25vw-vh7f",
  "modified": "2026-04-01T23:58:50Z",
  "published": "2026-04-01T23:58:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vercel/mcp-handler/security/advisories/GHSA-w2fm-25vw-vh7f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25536"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-345p-7cg4-v4c7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vercel/mcp-handler"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mcp-handler has a tool response leak across concurrent client sessions (\u0027Race Condition\u0027)"
}

CWE-1395

Dependency on Vulnerable Third-Party Component

Summary

Details

Impact

Impact

Summary

Details

Patches

References

Impact

Summary

Details

Patches

Workarounds

References

Impact

Patches

Workarounds

For more information

Impact

Workarounds

Impact

Patches

Workarounds

References

Patches

Workarounds

References

Summary

Impact

CVE-2025-24928

CVE-2024-56171

Description

Affected product and versions

Resolution

Acknowledgement

Impact

Patches

Workarounds

Mitigation

Mitigation

Mitigation

Mitigation

Mitigation