Tagged “ghsa”
CVEs tagged ghsa, newest first.
5757 CVEsRSS
CVE-2024-8551Critical· 9.1AgentScope path traversal vulnerability in save-workflow
AgentScope path traversal vulnerability in save-workflow
CVE-2024-6829Critical· 9.1Aim External Control of File Name or Path vulnerability
Aim External Control of File Name or Path vulnerability
CVE-2024-9070Critical· 9.8BentoML deserialization vulnerability
BentoML deserialization vulnerability
GHSA-w466-2wfc-8g58High· 7.5Open WebUI has vulnerable dependency on starlette via fastapi
Open WebUI has vulnerable dependency on starlette via fastapi
CVE-2024-8769Critical· 9.1Aim path traversal in LockManager.release_locks
Aim path traversal in LockManager.release_locks
CVE-2025-2000Critical· 9.8Qiskit allows arbitrary code execution decoding QPY format versions < 13
Qiskit allows arbitrary code execution decoding QPY format versions < 13
CVE-2025-26699Medium· 5.0Django Vulnerable to Allocation of Resources Without Limits or Throttling
Django Vulnerable to Allocation of Resources Without Limits or Throttling
CVE-2024-11831Medium· 5.4A flaw was found in npm-serialize-javascript
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject mali…
CVE-2025-24370CriticalDjango-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
CVE-2024-38819High· 7.5PoCSpring Framework Path Traversal vulnerability
Spring Framework Path Traversal vulnerability
CVE-2024-53262Low· 4.2@sveltejs/kit has unescaped error message included on error page
@sveltejs/kit has unescaped error message included on error page
CVE-2024-47533Critical· 9.8PoCcobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
CVE-2024-32651Critical· 10.0PoCchangedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
CVE-2024-7041Medium· 6.5open-webui Insecure Direct Object Reference (IDOR) vulnerability
open-webui Insecure Direct Object Reference (IDOR) vulnerability
CVE-2024-9675High· 7.8⚖ disputedA vulnerability was found in Buildah
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the…
CVE-2024-9355Medium· 6.5A vulnerability was found in Golang FIPS OpenSSL
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false posi…
CVE-2024-1728High· 8.1PoCGradio allows users to access arbitrary files
Gradio allows users to access arbitrary files
CVE-2024-46946Critical· 9.8LangChain Experimental Eval Injection vulnerability
LangChain Experimental Eval Injection vulnerability
CVE-2024-6091Critical· 9.8AutoGPT bypass of the shell commands denylist settings
AutoGPT bypass of the shell commands denylist settings
CVE-2024-45758Critical· 9.1H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
CVE-2024-6706Medium· 6.1Open WebUI Stored Cross-Site Scripting Vulnerability
Open WebUI Stored Cross-Site Scripting Vulnerability
CVE-2024-39896High· 7.5Directus Allows Single Sign-On User Enumeration
Directus Allows Single Sign-On User Enumeration
CVE-2024-38355Medium· 7.3PoCsocket.io has an unhandled 'error' event
socket.io has an unhandled 'error' event
CVE-2024-35059Critical· 9.8NASA AIT-Core vulnerable to remote code execution
NASA AIT-Core vulnerable to remote code execution
CVE-2024-35057High· 7.5NASA AIT-Core vulnerable to remote code execution
NASA AIT-Core vulnerable to remote code execution
CVE-2024-35056Critical· 9.8NASA AIT-Core vulnerable to SQL Injection
NASA AIT-Core vulnerable to SQL Injection
CVE-2024-35058High· 7.5NASA AIT-Core vulnerable to remote code execution
NASA AIT-Core vulnerable to remote code execution
CVE-2024-5023Critical· 9.6ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command
ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command
GHSA-pgj4-g5j4-cmfxHigh· 7.0Withdrawn Advisory: cart2quote/module-quotation-encoded Remote Code Execution via downloadCustomOptionAction
Withdrawn Advisory: cart2quote/module-quotation-encoded Remote Code Execution via downloadCustomOptionAction
CVE-2024-32874Critical· 9.3Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service
Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service