Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Browse Security Advisories

Security Advisories from github Clear Filters

High
19 days ago

SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS) GSA_kwCzR0hTQS0yOGdtLWpybXcteHg5M84ABgml

nuget SIPSorcery
Critical
19 days ago

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. GSA_kwCzR0hTQS0zNzM1LTUzMzkteGZ3eM4ABgmk

packagist poweradmin/poweradmin
High
19 days ago

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding GSA_kwCzR0hTQS04NXJnLXAzZnIteGMyZs4ABgmj

npm, pypi, maven qti-neon, com.quietterminal:qti-neon
High
19 days ago

OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host GSA_kwCzR0hTQS1wcDkyLWNyZzItZ2Z2Oc4ABgmi

rubygems oauth2
High
19 days ago

OAuth: Cross-origin token-request redirects can expose signed request metadata GSA_kwCzR0hTQS1wcnE4LTd3dmgtNDRxaM4ABgmh

rubygems oauth
Low
19 days ago

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks GSA_kwCzR0hTQS1qN2ZyLTN2OGMtM3FjM84ABgmg

rubygems sqlite3, sqlite3-ruby
Low
19 days ago

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity GSA_kwCzR0hTQS0yOGhoLXByMmgtMnc4Oc4ABgmf

rubygems sqlite3, sqlite3-ruby
Moderate
19 days ago

GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS GSA_kwCzR0hTQS1nNnYzLTd4bWMtdzU2M84ABgmX

go github.com/gopacket/gopacket
Moderate
19 days ago

GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS) GSA_kwCzR0hTQS02cjI4LTlwcGYtNGhqNc4ABgmW

go github.com/gopacket/gopacket
Moderate
19 days ago

nono-cli'scregistry pack verification can fail open when provenance metadata is absent GSA_kwCzR0hTQS1oYzRtLXE5amgteHc0as4ABgmV

cargo nono-cli
High
19 days ago

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions GSA_kwCzR0hTQS04cjZ3LTNxcTUtNHA0cs4ABgmU

go, packagist github.com/pterodactyl/wings, pterodactyl/panel
Moderate
19 days ago

@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition GSA_kwCzR0hTQS12ZzZ2LWo5N20taDV4cc4ABgli

npm @novu/application-generic
High
19 days ago

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) GSA_kwCzR0hTQS14dmMzLTgyNnYteGY0N84ABglh

packagist pterodactyl/panel
High
19 days ago

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities GSA_kwCzR0hTQS00cjlyLTQ0MjUtNzRwN84ABglg

maven com.cedarpolicy:cedar-java
High
19 days ago

@wakaru/cli arbitrary file write during bundle unpack GSA_kwCzR0hTQS03d3BqLXZ2bXYtcGdtOM4ABglf

npm @wakaru/cli
High
19 days ago

GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler GSA_kwCzR0hTQS13NHE2LXF3MjMtNHJnN84ABgle

go github.com/github/github-mcp-server
Critical
19 days ago

lettre has TLS hostname verification disabled when using Boring TLS backend GSA_kwCzR0hTQS00cGo5LWc4MzMtcXg1M84ABgld

cargo lettre
High
19 days ago

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability GSA_kwCzR0hTQS0zcHdwLWcybWotNXAzds4ABglc

packagist wp-coding-standards/wpcs
High
19 days ago

java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor GSA_kwCzR0hTQS0yOGY1LTM4eHItamgyd84ABglb

maven io.appium:java-client
Moderate
19 days ago

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method GSA_kwCzR0hTQS1ocDc0LWdtNm0tMnFtNc4ABgla

go github.com/pocket-id/pocket-id/backend
High
19 days ago

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions GSA_kwCzR0hTQS13NnA3LTJmeHgtNGY0NM4ABglZ

go github.com/pocket-id/pocket-id/backend
Moderate
20 days ago

org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages GSA_kwCzR0hTQS00ajM4LXJ3MjctOTdneM4ABf-A

maven org.xwiki.contrib:discussions-server
High
22 days ago

NLTK vulnerable to Eval Injection via collocations CLI arguments GSA_kwCzR0hTQS04NDhjLWMyY3gtajdxeM4ABftt

pypi nltk
High
22 days ago

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline GSA_kwCzR0hTQS02dmNoLXE5NmgtN2djM84ABftq

go go.etcd.io/etcd/v3
Moderate
22 days ago

FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller GSA_kwCzR0hTQS04cTQ5LTJoNWgtNDM0eM4ABftp

npm @frontmcp/adapters
Moderate
22 days ago

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema GSA_kwCzR0hTQS1qcGN3LTR3cjctYzN2cc4ABfto

go github.com/getkin/kin-openapi
High
22 days ago

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages() GSA_kwCzR0hTQS1qNmc1LTNoaDMtcGd3OM4ABftn

pypi bedrock-agentcore
High
22 days ago

etcd: Watch API authorization bypass via open-ended range requests GSA_kwCzR0hTQS14ZzRoLTZnZmMtaDRtOM4ABftm

go go.etcd.io/etcd/v3
High
22 days ago

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service GSA_kwCzR0hTQS1qdnhwLXFteDctZ2pweM4ABftl

cargo aws-smithy-http-server
High
22 days ago

libp2p: yamux connection DoS via oversized data frame GSA_kwCzR0hTQS1obWo4LTV4bWgtNTU3M84ABftk

pypi libp2p
Moderate
22 days ago

Quasar: Prototype pollution in the extend() utility GSA_kwCzR0hTQS0zcjUzLTc1ajUtM2c3as4ABftj

npm quasar
High
22 days ago

Oh My Posh: Arbitrary command execution via template injection in the path segment GSA_kwCzR0hTQS02eGo4LXF2OWoteGNqcc4ABfti

go github.com/jandedobbeleer/oh-my-posh
Moderate
22 days ago

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data GSA_kwCzR0hTQS1md2p4LTlwNjktaDI1aM4ABfth

go github.com/jandedobbeleer/oh-my-posh
High
22 days ago

OmniFaces: Forged combined-resource IDs and related output/push boundaries GSA_kwCzR0hTQS1mcDQzLXZqN2ctcGc5Ms4ABftg

maven org.omnifaces:omnifaces
High
22 days ago

Shescape: Quadratic-time denial of service in the flag-protection GSA_kwCzR0hTQS1nbTNyLXEyd3AtaHc4N84ABftf

npm shescape
Moderate
22 days ago

Shescape: Home-directory disclosure in assignment context on Unix with Dash GSA_kwCzR0hTQS1xNTNjLTRwcm0tdzk1cc4ABfte

npm shescape
Critical
22 days ago

Shescape: Shell injection via unescaped parentheses on Windows with CMD GSA_kwCzR0hTQS13NGh3LXFjeDctNTZwcs4ABftd

npm shescape
Moderate
22 days ago

Shescape: Path disclosure on Unix with Zsh GSA_kwCzR0hTQS02djRtLWZ3NjYtOHI0eM4ABftc

npm shescape
High
22 days ago

AWS API MCP Server Security Policy Bypass via Startup Initialization Failure GSA_kwCzR0hTQS0yOXcyLWZxMzUtdjcyOM4ABftb

pypi awslabs.aws-api-mcp-server
Moderate
22 days ago

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API GSA_kwCzR0hTQS04NmN4LXd3ZjQtcGhxNM4ABfta

go github.com/OpenListTeam/OpenList/v4
Moderate
22 days ago

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search GSA_kwCzR0hTQS1wNnBoLTNqeDItMzMzN84ABftZ

go github.com/OpenListTeam/OpenList/v4
High
22 days ago

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal GSA_kwCzR0hTQS05NWN2LXI4eDQtdmg3Nc4ABftY

go github.com/OpenListTeam/OpenList/v4
High
22 days ago

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server GSA_kwCzR0hTQS03cHByLXI4ODktbWNmMs4ABftX

maven org.http4s:http4s-blaze-server_3, org.http4s:http4s-blaze-server_2.12, org.http4s:http4s-blaze-server_2.13
High
22 days ago

blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass) GSA_kwCzR0hTQS00NnE0LTQzcGgtYzZmcs4ABftW

maven org.http4s:blaze-http_2.13, org.http4s:blaze-http_3, org.http4s:blaze-http_2.12
High
22 days ago

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser GSA_kwCzR0hTQS1taHZqLWpocHEtODg1ds4ABftV

maven org.http4s:blaze-http_2.13, org.http4s:blaze-http_3, org.http4s:http4s-blaze-server_2.13
High
22 days ago

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover GSA_kwCzR0hTQS1jbXdoLWcyaDgtYzIyMs4ABftU

packagist poweradmin/poweradmin
High
22 days ago

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own GSA_kwCzR0hTQS1ybTY3LWc5Y2gtdnhmZs4ABftT

packagist poweradmin/poweradmin
High
22 days ago

Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account GSA_kwCzR0hTQS1oNGhmLXY2dzUtODk3eM4ABftS

packagist poweradmin/poweradmin
Critical
22 days ago

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password GSA_kwCzR0hTQS1mMjV2LXg2dnItOTYyZ84ABftR

packagist pheditor/pheditor
High
22 days ago

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash GSA_kwCzR0hTQS1taDk5LXY5OW0tNGd2Z84ABftQ

npm brace-expansion
Moderate
22 days ago

swift-nio-http2: Missing CR/LF/NUL validation in header values GSA_kwCzR0hTQS1xM2cyLW01NTItM3I5Y84ABftP

swift swift-nio-http2
Critical
22 days ago

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock GSA_kwCzR0hTQS12aDQ1LWY4ODUtMzg0OM4ABftO

npm sm-crypto
Moderate
22 days ago

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests GSA_kwCzR0hTQS12Nnc2LTM1OHgtMjQzM84ABftN

go github.com/cloudreve/Cloudreve/v3, github.com/cloudreve/Cloudreve/v4
High
22 days ago

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review GSA_kwCzR0hTQS00N3c2LWd3cDQtdzZ2Y84ABftM

pypi vantage6
Low
22 days ago

Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics GSA_kwCzR0hTQS0yNjI1LXJ3N20tNXE1eM4ABftL

cargo hubuum_client
Moderate
22 days ago

Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic GSA_kwCzR0hTQS1xcWMzLTk0cXYtN2Z3M84ABftK

cargo hubuum_client
Moderate
22 days ago

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects GSA_kwCzR0hTQS1mNDVxLXc2Mjktd3IyNc4ABftJ

cargo hubuum_client
High
22 days ago

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow GSA_kwCzR0hTQS0yNmdxLXAyNWYtOTljcM4ABftI

go github.com/fatedier/frp
High
22 days ago

@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion GSA_kwCzR0hTQS1nNXZ2LXE3MmMtN2o3OM4ABftH

npm @anephenix/hub
Moderate
22 days ago

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources GSA_kwCzR0hTQS1jNTM0LTJ3OWMteDdmbc4ABftG

go github.com/zxh326/kite
Critical
22 days ago

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check GSA_kwCzR0hTQS1wMjc5LTJjcXAtODRqZ84ABftF

maven org.openidentityplatform.opendj:opendj-server-legacy
Critical
22 days ago

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway GSA_kwCzR0hTQS02OHI1LTlocGctN3F3Oc4ABftE

maven org.openidentityplatform.opendj:opendj-dsml-servlet
High
22 days ago

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes GSA_kwCzR0hTQS1nM2hxLWhwaGctOGZoaM4ABftD

packagist pheditor/pheditor
High
22 days ago

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573) GSA_kwCzR0hTQS05NHA0LTRjcTgtOWc2N84ABftC

pypi GitPython
Moderate
22 days ago

Budibase: SSRF via bare fetch() in uploadUrl during AI table generation GSA_kwCzR0hTQS1oZmh4LXc4cDgtNGhjN84ABftB

npm @budibase/server
High
22 days ago

Budibase: SSRF via DNS rebinding in the REST datasource integration GSA_kwCzR0hTQS12NDJmLXY4eGMtajQzNc4ABftA

npm @budibase/server
High
22 days ago

Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete GSA_kwCzR0hTQS1wbXBnLTJteHEtNnh3cs4ABfs_

npm @budibase/server
Moderate
22 days ago

Budibase: Account Enumeration via Login Lockout Response Differential GSA_kwCzR0hTQS1jcjdwLWNyM3EtaDVjbc4ABfs-

npm @budibase/server
High
22 days ago

Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF) GSA_kwCzR0hTQS1wdmNyLThtdnAtdzhxcs4ABfs9

npm @budibase/server
High
22 days ago

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector GSA_kwCzR0hTQS0yeGdnLXIyd2MtYzVyMs4ABfsy

npm @budibase/server
High
22 days ago

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution GSA_kwCzR0hTQS1xdzZtLThmdzItMnY2NM4ABfsx

npm @budibase/server
Moderate
22 days ago

Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders GSA_kwCzR0hTQS1naDRoLTM0Z3ItODdyN84ABfsw

npm @budibase/server
High
22 days ago

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint GSA_kwCzR0hTQS1ocjY2LTVtcXItOG1weM4ABfsv

npm @budibase/server
Critical
22 days ago

Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak GSA_kwCzR0hTQS1tcWhyLTZqNmgtNzRwNc4ABfsu

npm @budibase/server
Moderate
22 days ago

Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored GSA_kwCzR0hTQS1jM2ptLWd2NXItOXdjcM4ABfst

go github.com/cloudreve/Cloudreve/v3, github.com/cloudreve/Cloudreve/v4
Critical
22 days ago

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified GSA_kwCzR0hTQS1ocDZ2LTZqdzctZ3YyZs4ABfss

npm @budibase/server
High
22 days ago

Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution GSA_kwCzR0hTQS14ZzVnLTI2eDgtY3ZmNM4ABfsr

npm @budibase/server
High
22 days ago

Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs GSA_kwCzR0hTQS14Y3g2LTRmMmctaGhneM4ABfsq

npm @budibase/server
High
22 days ago

Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile GSA_kwCzR0hTQS1wcHI0LTVmNDYtajljNs4ABfsp

npm @budibase/server
Critical
22 days ago

Budibase: SQL Injection via `multipleStatements: true` GSA_kwCzR0hTQS1xNng0LXYzcXgtODVxd84ABfso

npm @budibase/server
High
22 days ago

Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) GSA_kwCzR0hTQS1jOHZjLTdwdjMtZzk4cM4ABfsn

npm @budibase/server
Moderate
22 days ago

Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users GSA_kwCzR0hTQS1mY3J3LWY3Z2ctNmc5Zs4ABfsm

npm @budibase/server
Moderate
22 days ago

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings GSA_kwCzR0hTQS00cWNqLW01d3Atam1mNM4ABfsl

npm @budibase/server
High
22 days ago

Budibase: Privilege escalation via public role assignment API missing app-level authorization GSA_kwCzR0hTQS1qOWZjLXczbXIteDZtds4ABfsk

npm @budibase/server
High
22 days ago

react-server-dom: Denial of Service in Server Functions GSA_kwCzR0hTQS13eDY3LXF3ODQtY200Z84ABfsj

npm react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack
Critical
22 days ago

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback GSA_kwCzR0hTQS13ZzVyLXdjM3gtMzl2Y84ABfsi

maven org.openidentityplatform.openam:openam-core
Moderate
22 days ago

OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page GSA_kwCzR0hTQS12cXh2LTZ4cmgtNDljcM4ABfsh

maven org.openidentityplatform.openam:openam-oauth2
Critical
22 days ago

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass GSA_kwCzR0hTQS1nZjhoLWdxNTMtMjg4as4ABfsg

maven org.openidentityplatform.openam:openam-auth-webauthn
High
22 days ago

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal GSA_kwCzR0hTQS1mcnZqLWM1cXAteGo0d84ABfsf

pypi open-webui
Moderate
22 days ago

Open WebUI: Arena task endpoints can bypass underlying model access controls GSA_kwCzR0hTQS1tM3FmLTU4d2Ytdzk3Oc4ABfse

pypi open-webui
Moderate
22 days ago

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete GSA_kwCzR0hTQS0yeHdtLTRoMnEtZ2dmeM4ABfsd

pypi open-webui
High
22 days ago

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection) GSA_kwCzR0hTQS1qNjU3LW00YzQtMjRqcc4ABfsc

pypi open-webui
Moderate
22 days ago

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching GSA_kwCzR0hTQS1xZzNmLTh4M2otZ2dmMs4ABfsb

pypi open-webui
Moderate
22 days ago

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules GSA_kwCzR0hTQS1nMzVqLW01eGctdmgzcc4ABfsa

go github.com/quic-go/webtransport-go
High
22 days ago

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials GSA_kwCzR0hTQS1ocTg4LTV4OTkteDNnZs4ABfsZ

go github.com/cloudreve/Cloudreve/v3, github.com/cloudreve/Cloudreve/v4
Moderate
22 days ago

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings GSA_kwCzR0hTQS13OHg3LWgycHgteG1xOM4ABfsY

go github.com/cloudreve/Cloudreve/v3, github.com/cloudreve/Cloudreve/v4
Moderate
22 days ago

Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server GSA_kwCzR0hTQS1nOWoyLTh3OTUtM3Z3ds4ABfsX

go github.com/cloudreve/Cloudreve/v3, github.com/cloudreve/Cloudreve/v4
Moderate
22 days ago

Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails GSA_kwCzR0hTQS04cjdmLXI4aGotcjNyds4ABfsW

go github.com/cloudreve/Cloudreve/v3, github.com/cloudreve/Cloudreve/v4
Moderate
22 days ago

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account GSA_kwCzR0hTQS00OWgzLWN3aGotNDczN84ABfsV

go github.com/cloudreve/Cloudreve/v3, github.com/cloudreve/Cloudreve/v4
High
22 days ago

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output GSA_kwCzR0hTQS02djRqLTQzZ2ctdmozMs4ABfsU

pypi yt-dlp

Filter by Severity

Moderate 14,628 High 12,013 Critical 4,430 Low 2,461

Filter by Source

CPAN Security Advisory Database 1,054 Erlang Ecosystem Foundation 171 GitHub Advisory Database 34,444

Filter by Ecosystem

maven 7,948 npm 7,343 packagist 6,821 pypi 6,749 go 5,127 nuget 4,336 cargo 1,657 rubygems 1,096 hex 108 actions 57 swift 52 pub 11

Filter by Package

openclaw 591 moodle/moodle 437 tensorflow 433 tensorflow-cpu 409 tensorflow-gpu 398 magento/community-edition 361 org.jenkins-ci.main:jenkins-core 259 Microsoft.ChakraCore 247 github.com/mattermost/mattermost/server/v8 199 github.com/mattermost/mattermost-server 174 typo3/cms 167 Magick.NET-Q16-AnyCPU 161 Magick.NET-Q16-HDRI-AnyCPU 159 Magick.NET-Q16-HDRI-OpenMP-arm64 154 org.apache.tomcat:tomcat 154 Magick.NET-Q16-HDRI-x86 150 com.liferay.portal:release.portal.bom 150 Magick.NET-Q16-HDRI-x64 149 open-webui 147 Magick.NET-Q16-HDRI-arm64 146 Magick.NET-Q16-OpenMP-arm64 145 wwbn/avideo 144 Magick.NET-Q16-x86 144 Magick.NET-Q16-OpenMP-x64 144 Magick.NET-Q8-AnyCPU 143 Magick.NET-Q16-arm64 143 n8n 139 Magick.NET-Q8-x86 138 Magick.NET-Q16-x64 137 Magick.NET-Q8-arm64 137 Magick.NET-Q8-OpenMP-arm64 136 Magick.NET-Q8-OpenMP-x64 135 pimcore/pimcore 133 Magick.NET-Q8-x64 130 apache-airflow 128 craftcms/cms 127 dolibarr/dolibarr 126 com.liferay.portal:release.dxp.bom 125 concrete5/concrete5 121 magento/project-community-edition 120 typo3/cms-core 120 parse-server 116 flowise 112 Django 107 drupal/core 107 phpmyadmin/phpmyadmin 107 thorsten/phpmyfaq 106 microweber/microweber 105 librenms/librenms 101 org.keycloak:keycloak-services 97 code.gitea.io/gitea 94 symfony/symfony 90 silverstripe/framework 90 Magick.NET-Q16-HDRI-OpenMP-x64 86 mlflow 79 com.fasterxml.jackson.core:jackson-databind 79 github.com/usememos/memos 75 gogs.io/gogs 75 shopware/platform 74 mantisbt/mantisbt 74 drupal/drupal 72 getgrav/grav 70 salt 67 apache-superset 66 ansible 65 shopware/core 64 electron 64 next 64 github.com/grafana/grafana 62 github.com/rancher/rancher 61 Magick.NET-Q16-OpenMP-x86 61 vllm 60 actionpack 59 org.apache.struts:struts2-core 59 picklescan 59 github.com/siyuan-note/siyuan/kernel 58 directus 58 mautic/core 57 snipe/snipe-it 57 org.apache.tomcat.embed:tomcat-embed-core 56 django 56 nokogiri 56 baserproject/basercms 56 github.com/hashicorp/vault 55 froxlor/froxlor 55 nocodb 54 Plone 54 surrealdb 53 github.com/traefik/traefik/v3 51 rack 50 org.keycloak:keycloak-core 50 admidio/admidio 50 github.com/traefik/traefik/v2 50 gradio 49 nova 48 pyload-ng 48 getkirby/cms 47 hono 47 aiohttp 47 org.xwiki.platform:xwiki-platform-oldcore 46 matrix-synapse 45 vyper 44 org.elasticsearch:elasticsearch 44 axios 43 statamic/cms 43 rdiffweb 43 vm2 43 showdoc/showdoc 42 k8s.io/kubernetes 42 pillow 42 nilsteampassnet/teampass 42 ghost 41 phpmyfaq/phpmyfaq 41 plone 41 intelliants/subrion 41 @budibase/server 41 github.com/filebrowser/filebrowser/v2 41 pypdf 39 io.undertow:undertow-core 39 praisonai 39 net.mingsoft:ms-mcms 39 wasmtime 39 keystone 39 github.com/zitadel/zitadel 38 github.com/mattermost/mattermost-server/v6 38 com.thoughtworks.xstream:xstream 37 github.com/argoproj/argo-cd/v2 37 PraisonAI 37 github.com/cilium/cilium 37 com.jfinal:jfinal 36 DotNetNuke.Core 36 deno 36 ci4-cms-erp/ci4ms 36 undici 35 moin 35 org.apache.tomcat:tomcat-catalina 35 github.com/hashicorp/nomad 34 github.com/answerdev/answer 34 shopware/shopware 34 org.jenkins-ci.plugins:script-security 34 Pillow 33 contao/core-bundle 33 kimai/kimai 33 praisonaiagents 33 code.vikunja.io/api 33 github.com/docker/docker 33 zendframework/zendframework1 32 github.com/hashicorp/consul 32 langflow 32 github.com/argoproj/argo-cd 32 phpoffice/phpspreadsheet 31 yeswiki/yeswiki 31 prestashop/prestashop 31 org.opencms:opencms-core 31 opencv-contrib-python 31 opencv-python 31 org.apache.solr:solr-core 30 pocketmine/pocketmine-mp 30 org.springframework.security:spring-security-core 30 litellm 29 org.eclipse.jetty:jetty-server 29 mediawiki/core 28 github.com/fleetdm/fleet/v4 28 dompurify 28 github.com/traefik/traefik 28 @anthropic-ai/claude-code 28 flowise-components 28 pnpm 28 centreon/centreon 27 zebrad 27 github.com/nats-io/nats-server/v2 27 funadmin/funadmin 26 github.com/coder/coder/v2 26 facturascripts/facturascripts 26 github.com/ethereum/go-ethereum 26 github.com/openfga/openfga 26 openmage/magento-lts 26 pgadmin4 26 github.com/openbao/openbao 26 org.keycloak:keycloak-parent 26 cockpit-hq/cockpit 26 openssl-src 25 grumpydictator/firefly-iii 25 laravel/framework 25 astro 25 rubygems-update 25 GitPython 25 golang.org/x/crypto 25 org.apache.openmeetings:openmeetings-parent 25 cryptography 24 openbabel 24 org.springframework:spring-webmvc 24 org.bouncycastle:bcprov-jdk14 24 twig/twig 24 org.xwiki.platform:xwiki-platform-web-templates 23 github.com/goharbor/harbor 23 remdex/livehelperchat 23 simplesamlphp/simplesamlphp 23 activerecord 23 weblate 23

Filter by Repository

https://github.com/tensorflow/tensorflow 433 https://github.com/moodle/moodle 250 https://github.com/xwiki/xwiki-platform 222 https://github.com/chakra-core/ChakraCore 214 https://github.com/jenkinsci/jenkins 178 https://github.com/liferay/liferay-portal 170 https://github.com/django/django 121 https://github.com/apache/tomcat 118 https://github.com/pimcore/pimcore 116 https://github.com/apache/airflow 105 https://github.com/TYPO3/typo3 93 https://github.com/microweber/microweber 90 https://github.com/keycloak/keycloak 90 https://github.com/librenms/librenms 77 https://github.com/FasterXML/jackson-databind 70 https://github.com/rails/rails 70 https://github.com/thorsten/phpmyfaq 69 https://github.com/usememos/memos 68 https://github.com/silverstripe/silverstripe-framework 68 https://github.com/kubernetes/kubernetes 66 https://github.com/symfony/symfony 64 https://github.com/Dolibarr/dolibarr 60 https://github.com/ansible/ansible 59 https://github.com/mattermost/mattermost 59 https://github.com/python-pillow/Pillow 52 https://github.com/spring-projects/spring-framework 51 https://github.com/argoproj/argo-cd 50 https://github.com/grafana/grafana 47 https://github.com/apache/struts 47 https://github.com/rancher/rancher 46 https://github.com/mautic/mautic 46 https://github.com/phpmyadmin/phpmyadmin 45 https://github.com/concretecms/concretecms 44 https://github.com/vyperlang/vyper 44 https://github.com/mantisbt/mantisbt 42 https://github.com/shopware/platform 42 https://github.com/ikus060/rdiffweb 42 https://github.com/saltstack/salt 42 https://github.com/directus/directus 41 https://github.com/craftcms/cms 41 https://github.com/shopware/shopware 40 https://github.com/star7th/showdoc 39 https://github.com/mmaitre314/picklescan 39 https://github.com/dotnet/runtime 38 https://github.com/openstack/nova 38 https://github.com/magento/magento2 38 https://github.com/gradio-app/gradio 38 https://github.com/plone/Products.CMFPlone 37 https://github.com/x-stream/xstream 37 https://github.com/mlflow/mlflow 36 https://github.com/octobercms/october 36 https://github.com/sparklemotion/nokogiri 35 https://github.com/umbraco/Umbraco-CMS 35 https://github.com/parse-community/parse-server 34 https://github.com/answerdev/answer 34 https://github.com/apache/activemq 34 https://github.com/go-gitea/gitea 32 https://github.com/matrix-org/synapse 32 https://github.com/opencv/opencv 32 https://github.com/apache/inlong 31 https://github.com/cilium/cilium 31 https://github.com/PaddlePaddle/Paddle 31 https://github.com/contao/contao 30 https://github.com/snipe/snipe-it 30 https://github.com/rack/rack 29 https://github.com/electron/electron 28 https://github.com/gogs/gogs 28 https://github.com/openstack/keystone 28 https://github.com/CVEProject/cvelist 28 https://github.com/strapi/strapi 28 https://github.com/FlowiseAI/Flowise 28 https://github.com/netty/netty 27 https://github.com/apache/nifi 26 https://github.com/froxlor/froxlor 26 https://github.com/github/advisory-database 26 https://github.com/baserproject/basercms 26 https://github.com/geoserver/geoserver 26 https://github.com/zitadel/zitadel 26 https://github.com/traefik/traefik 25 https://github.com/vllm-project/vllm 25 https://github.com/vercel/next.js 25 https://github.com/pmmp/PocketMine-MP 25 https://github.com/langchain-ai/langchain 25 https://github.com/denoland/deno 25 https://github.com/bcgit/bc-java 25 https://github.com/surrealdb/surrealdb 25 https://github.com/hashicorp/consul 24 https://github.com/getgrav/grav 24 https://github.com/apache/cxf 24 https://github.com/run-llama/llama_index 24 https://github.com/pyload/pyload 24 https://github.com/PrestaShop/PrestaShop 23 https://github.com/livehelperchat/livehelperchat 23 https://github.com/eclipse/jetty.project 23 https://github.com/firefly-iii/firefly-iii 23 https://github.com/bytecodealliance/wasmtime 23 https://github.com/nilsteampassnet/TeamPass 23 https://github.com/dnnsoftware/Dnn.Platform 23 https://github.com/TYPO3/TYPO3.CMS 23 https://github.com/moby/moby 23 https://github.com/helm/helm 22 https://github.com/PHPOffice/PhpSpreadsheet 22 https://github.com/jenkinsci/script-security-plugin 22 https://github.com/getkirby/kirby 22 https://github.com/nervosnetwork/ckb 22 https://github.com/laravel/framework 21 https://github.com/goharbor/harbor 21 https://github.com/OpenZeppelin/openzeppelin-contracts 21 https://github.com/hashicorp/vault 21 https://github.com/undertow-io/undertow 21 https://github.com/funadmin/funadmin 20 https://github.com/OpenNMS/opennms 20 https://github.com/opencast/opencast 20 https://github.com/jeecgboot/jeecg-boot 20 https://github.com/ethyca/fides 20 https://github.com/huggingface/transformers 19 https://github.com/backstage/backstage 19 https://github.com/simplesamlphp/simplesamlphp 19 https://github.com/cloudfoundry/uaa 19 https://github.com/alkacon/opencms-core 19 https://github.com/TYPO3-CMS/core 19 https://github.com/intelliants/subrion 19 https://github.com/containerd/containerd 19 https://github.com/nilsteampassnet/teampass 19 https://github.com/opencontainers/runc 18 https://github.com/vaadin/platform 18 https://github.com/rubygems/rubygems 18 https://github.com/apache/camel 18 https://github.com/OpenMage/magento-lts 18 https://github.com/ethereum/go-ethereum 17 https://github.com/openfga/openfga 17 https://github.com/liufee/cms 17 https://github.com/vantage6/vantage6 17 https://github.com/apache/kylin 17 https://github.com/mindsdb/mindsdb 17 https://github.com/dotnet/aspnetcore 16 https://github.com/pyca/cryptography 16 https://github.com/forkcms/forkcms 16 https://github.com/sequelize/sequelize 16 https://github.com/hashicorp/nomad 16 https://github.com/quarkusio/quarkus 16 https://github.com/tinymce/tinymce 16 https://github.com/yetiforcecompany/yetiforcecrm 16 https://github.com/etcd-io/etcd 16 https://github.com/rusqlite/rusqlite 16 https://github.com/vitejs/vite 16 https://github.com/OPCFoundation/UA-.NETStandard 15 https://github.com/MobSF/Mobile-Security-Framework-MobSF 15 https://github.com/ckeditor/ckeditor4 15 https://github.com/containers/podman 15 https://github.com/zendframework/zendframework 15 https://github.com/xuxueli/xxl-job 15 https://github.com/centreon/centreon 15 https://github.com/aio-libs/aiohttp 15 https://github.com/puppetlabs/puppet 15 https://github.com/dompdf/dompdf 15 https://github.com/decidim/decidim 15 https://github.com/thorsten/phpMyFAQ 15 https://github.com/PHPMailer/PHPMailer 15 https://github.com/spring-projects/spring-security 15 https://github.com/drupal/core 15 https://github.com/cobbler/cobbler 15 https://github.com/nodejs/undici 15 https://github.com/golang/go 14 https://github.com/TryGhost/Ghost 14 https://github.com/twisted/twisted 14 https://github.com/apache/zeppelin 14 https://github.com/rails/rails-html-sanitizer 14 https://github.com/pgadmin-org/pgadmin4 14 https://github.com/cosmos/cosmos-sdk 14 https://github.com/janeczku/calibre-web 14 https://github.com/ImageMagick/ImageMagick 14 https://github.com/Graylog2/graylog2-server 14 https://github.com/cockpit-hq/cockpit 14 https://github.com/pimcore/admin-ui-classic-bundle 14 https://github.com/apache/superset 14 https://github.com/ming-soft/MCMS 14 https://github.com/urllib3/urllib3 14 https://github.com/publify/publify 14 https://github.com/dpgaspar/Flask-AppBuilder 14 https://github.com/zenml-io/zenml 13 https://github.com/h2oai/h2o-3 13 https://github.com/OpenRefine/OpenRefine 13 https://github.com/laurent22/joplin 13 https://github.com/1Panel-dev/1Panel 13 https://github.com/swagger-api/swagger-ui 13 https://github.com/apache/dolphinscheduler 13 https://github.com/dromara/hutool 13 https://github.com/OctoPrint/OctoPrint 13 https://github.com/modoboa/modoboa 13 https://github.com/openbao/openbao 13 https://github.com/modxcms/revolution 12 https://github.com/igniterealtime/Openfire 12 https://github.com/getsentry/sentry 12 https://github.com/centreon/centreon-archived 12 https://github.com/n8n-io/n8n 12 https://github.com/smarty-php/smarty 12 https://github.com/matrix-org/matrix-js-sdk 12 https://github.com/codeigniter4/CodeIgniter4 12