CVE Watchtower

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_get_bits() ...

NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows at...

NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message Service daemon (amsd) that allo...

NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon (nm_mgr) string-formatting logic that allo...

rConfig Core 8.2.3 before 8.2.13 contains an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, a...

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a posi...

During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the inst...

A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes a...

SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenan...

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component ...

Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In st...

The Android implementation of the Flutter/Dart receive_sharing_intent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability i...

### Impact This is an incomplete fix for GHSA-jf3h-8jvx-vcrg. 0.32.0 made findings quote the `${NAME}` a sibling `.env` filled in, instead of its val...

### Impact Like Docker Compose, compose-lint follows symlinks when it reads a project's files. Unlike Compose, compose-lint up to 0.24.0 could t...

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint...

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint ...

### Impact `compose-lint fix --apply` converts the line numbers its fixers work with into positions in the file. The YAML parser treats a lone carria...

### Impact The GitHub Actions runner treats certain text in a step's output as commands. The legacy form, `##[command]`, is recognized anywhere ...

Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unau...

Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass R...