CVE Browser

mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

CodeWhale before 0.8.64 Environment Variable Leak via js_execution

CodeWhale before 0.8.64 Path Traversal via image_analyze symlink

CodeWhale before 0.8.64 Argument Injection via git_show

CodeWhale before 0.8.64 Argument Injection via git_blame

CodeWhale before 0.8.64 Remote Code Execution via allow_shell

CodeWhale before 0.8.64 Arbitrary File Read via instructions

CodeWhale rlm_eval before 0.8.64 Remote Code Execution

CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interact

CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU

SWC HTML minifier may allow script element breakout when minifying embedded JSON

Shamefile has an arbitrary file read via shamefile.yaml in shame next

Prompty: Arbitrary File Read via ${file:path} Reference Expansion

BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files

BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host

CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval

CodeWhale: SSRF via HTTP Redirect Bypass in fetch_url Tool

RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport

dcap-qvl has Missing Verification for QE Identity

Improper Scope Validation in the open Endpoint of tauri-plugin-shell

sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function. This vulnerability allows attackers to cause a Denial of Se…

Pagefind DOM clobbering could escalate to Cross-site Scripting (XSS)

Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries

ssh: Prefix truncation attack on Binary Packet Protocol (BPP)

Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the p…