CVE Watchtower

bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticate...

The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. A...

pympp is a Python SDK for the Machine Payments Protocol. Prior to version 0.9.1, when the server acts as the fee_payer, pympp validates calldata using...

A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file exllamav3/e...

A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escape_bytes of the file crates/nu-json/src/ser.rs of the component ...

TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference in std.FileUpload columns, where the Record API accepts attacker-supplied...

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 and iPadOS...

Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side H...

The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each ent...

SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTS...

Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that conse...

In apport before 2.37.0, an improper privilege management vulnerability allows an unprivileged local attacker to gain root privileges on systems where...

In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or ...

A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipu...

Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExec...

A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classifi...

A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the decl...

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repea...

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment...

SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3....