CWE-1395

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "pl.allegro.tech.hermes:hermes-management"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.2"
            },
            {
              "fixed": "2.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-17T19:29:24Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\nhermes-management is vulnerable to RCE when it processes user-controlled data due to using Apache commons-jxpath.\n\n### Patches\nUpgrade Hermes to at least hermes-2.2.9\n\n### References\nhttps://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/",
  "id": "GHSA-2gh6-wc3m-g37f",
  "modified": "2026-08-31T22:59:09Z",
  "published": "2024-09-17T19:29:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/allegro/hermes/security/advisories/GHSA-2gh6-wc3m-g37f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/allegro/hermes/commit/72ecc5aa41e37fd614443dd35d9200b66a61afb1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/allegro/hermes/commit/92d4ad0cf6868ba784707772b78e129fedff7a31"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/allegro/hermes"
    },
    {
      "type": "WEB",
      "url": "https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "hermes-management is vulnerable to RCE due to Apache commons-jxpath"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "skia-python"
      },
      "versions": [
        "144.0"
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 138.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "skia-python"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "144.0.post1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-19T18:10:25Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nThe Linux wheels for skia-python vendor a vulnerable version of\nlibfreetype that is affected by CVE-2025-27363 [1].\n\nThe root cause is a chain of unfortunate events:\n\n1. skia-python builds wheels using pinned pypa/cibuildwheel@2.21.3 [2]\n\n2. cibuildwheel 2.21.3 in turn pins manylinux container images [3]\n\n3. In these images, version 2.9.1-9.el8 of RedHat package freetype is\n*preinstalled*. This package version is vulnerable and has since been\npatched in 2.9.1-10.\n\n4. During the skia-python Linux build, libfreetype is vendored from the\nsystem, resulting in skia-python.libs/libfreetype-29a7443c.so.6.16.1\n\n[ To find the provenance of your vendored libfreetype, we extracted the\n8-character hash of the original binary file that is added during the\nbuild process (29a7443c), and matched it against our database of hashes\nall historic Red Hat, Debian and Ubuntu releases of freetype. ]\n\n5. Because freetype is only a *transitive* dependency of the packages\nexplicitly installed by the build script [4], it is not upgraded to the\npatched version [4].\n\n5. As a result, the published wheels embed a vulnerable libfreetype,\neven though patched packages are available upstream.\n\nThis appears to be a broader manylinux ecosystem issue. The base images\ndo not enforce that `yum update` runs on container start, so\npreinstalled libraries may remain vulnerable indefinitely.\n\n\n### Patches\n\n\u003e In the case of skia-python, the solution is to explicitly install freetype in the build process and rebuild the wheels.\n\nThe original report was suggesting the above, but in the current `build_Linux.sh` script, the patched `freetype-devel` version 2.9.1-10 gets installed as a dependency. It\u0027s just that we need to rebuild the wheel for a new release.\n\n### Workarounds\n\nUsers must upgrade the wheel package after release.\n\n### References\n\n1. https://nvd.nist.gov/vuln/detail/CVE-2025-27363\n2. https://github.com/kyamagu/skia-python/blob/9ffb045811f9b5508e152302d5b81aadca6edd8d/.github/workflows/ci.yml#L38\n3. https://github.com/pypa/cibuildwheel/blob/v2.21.3/cibuildwheel/resources/pinned_docker_images.cfg\n4. https://github.com/kyamagu/skia-python/blob/9ffb045811f9b5508e152302d5b81aadca6edd8d/scripts/build_Linux.sh#L6",
  "id": "GHSA-2mhw-8qcg-gr96",
  "modified": "2026-03-19T18:10:25Z",
  "published": "2026-03-19T18:10:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kyamagu/skia-python/security/advisories/GHSA-2mhw-8qcg-gr96"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27363"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kyamagu/skia-python"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "15.5.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "16.0.0"
            },
            {
              "fixed": "16.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T21:21:12Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.\n\nUntil a fix has propagated, optimization of AVIF files is disabled.",
  "id": "GHSA-2xp9-vwfh-vxw4",
  "modified": "2026-09-08T21:21:12Z",
  "published": "2026-09-08T21:21:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/pull/97875"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/pull/97931"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vercel/next.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/releases/tag/v15.5.24"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/releases/tag/v16.3.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "EnhancedLinq.Async"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0-beta.1"
            },
            {
              "fixed": "1.0.0-beta.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-129",
      "CWE-1395"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T23:57:06Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n`Microsoft.Bcl.Memory`, a transitive dependency of `EnhancedLinq.Async`, had a Denial of Service security vulnerability, [CVE-2026-26127](https://github.com/dotnet/announcements/issues/384), thus affecting `EnhancedLinq.Async` versions that had vulnerable versions of `Microsoft.Bcl.Memory` as a transitive dependency.\n\n### Patches\n`EnhancedLinq.Async` 1.0.0 Beta 3 updates the dependency on `System.Linq.AsyncEnumerable` to version 10.0.4 or newer which in turn updates the transitive dependency on `Microsoft.Bcl.Memory` from version 10.0.3 to 10.0.4 or newer, resolving the vulnerability.\n\n### Workarounds\nNo workarounds exist for this vulnerability.\n\n### How to fix the issue\n\nTo update the `EnhancedLinq.Async` NuGet package, use one of the following methods:\n\n**NuGet Package Manager UI in Visual Studio:**\n- Open the project in Visual Studio.\n- Right-click on the project in Solution Explorer and select \"Manage NuGet Packages...\" or navigate to \"Project \u003e Manage NuGet Packages\".\n- In the NuGet Package Manager window, select the \"Updates\" tab. This tab lists packages with available updates from configured package sources.\n- Select the package(s) to update. A specific version can be chosen from the dropdown, or the latest available version can be selected.\n- Click the \"Update\" button.\n\n**Using the NuGet Package Manager Console in Visual Studio:**\n- Open the project in Visual Studio.\n- Navigate to \"Tools \u003e NuGet Package Manager \u003e Package Manager Console\".\n- To update a specific package to its latest version, use the following Update-Package command:\n\n```\nUpdate-Package -Id EnhancedLinq.Async\n```\n\n**Using the .NET CLI (Command Line Interface):**\n- Open a terminal or command prompt in the project\u0027s directory.\n- To update a specific package to its latest version, use the following add package command:\n\n```\ndotnet package update EnhancedLinq.Async\n```\n\nOnce the NuGet package reference has been updated, the application must be recompiled and redeployed.",
  "id": "GHSA-32wq-ppwg-3w4m",
  "modified": "2026-04-01T23:57:06Z",
  "published": "2026-04-01T23:57:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/alastairlundy/EnhancedLinq/security/advisories/GHSA-32wq-ppwg-3w4m"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/announcements/issues/384"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/alastairlundy/EnhancedLinq"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-26127"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "ntpd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-24T22:18:39Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "During startup, an attacker that can man-in-the-middle traffic to and from NTS key exchange servers can trigger a very expensive key validation process due to a vulnerability in webpki.\n\n### Impact\nThis vulnerability can lead to excessive cpu usage on startup on clients configured to use NTS\n\n### Patches\nAffected users are recommended to upgrade to version 0.3.7\n\n### References\nSee also https://github.com/rustsec/advisory-db/blob/main/crates/rustls-webpki/RUSTSEC-2023-0053.md\n",
  "id": "GHSA-37xq-q42p-rv3p",
  "modified": "2024-06-26T15:20:09Z",
  "published": "2023-08-24T22:18:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-37xq-q42p-rv3p"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pendulum-project/ntpd-rs/commit/927952a440176a18f3ded132eb831ae7f7ac5c00"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pendulum-project/ntpd-rs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rustsec/advisory-db/blob/main/crates/rustls-webpki/RUSTSEC-2023-0053.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ntpd has Dependency on Vulnerable Third-Party Component"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@excalidraw/excalidraw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.18.0"
            },
            {
              "fixed": "0.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.18.0"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@excalidraw/mermaid-to-excalidraw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.0"
            },
            {
              "fixed": "1.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-24T20:41:51Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\n`@excalidraw/excalidraw@0.18.0` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid\u2019s KaTeX label rendering path.\n\nThis is patched in `@excalidraw/excalidraw@0.18.1` by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2`, which uses a patched Mermaid 11 release.\n\nModerate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).\n\n### Patches\n\n- Stable `@excalidraw/excalidraw@0.18.1` is patched.\n- Unstable `@excalidraw/excalidraw@next` has resolved to patched builds since `@excalidraw/excalidraw@0.18.0-f29edf` on 2025-08-21.\n- Direct consumers of `@excalidraw/mermaid-to-excalidraw` should use `1.1.3` or later.\n\n### Workarounds\n\nNone.\n\n### Resources\n\n- Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh\n- CVE-2025-54881",
  "id": "GHSA-39h7-pwv7-rc3x",
  "modified": "2026-04-24T20:41:51Z",
  "published": "2026-04-24T20:41:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/excalidraw/excalidraw/security/advisories/GHSA-39h7-pwv7-rc3x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/excalidraw/excalidraw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/excalidraw/excalidraw/releases/tag/v0.18.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@lightdash/cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1800.0"
            },
            {
              "fixed": "0.2695.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-508"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-02T18:36:10Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nA supply chain attack on the `axios` npm package (versions 1.14.1 and 0.30.4) introduced a malicious transitive dependency (`plain-crypto-js@4.2.1`) that deploys a cross-platform remote access trojan (RAT) on macOS, Windows, and Linux. The attacker compromised the primary axios maintainer\u0027s npm account to publish the malicious versions.\n\nThe malicious versions were live on npm for approximately 3 hours (00:21 UTC to 03:29 UTC on March 31, 2026) before being removed.\n\nThe `@lightdash/cli` package specified axios as a dependency with a semver range (`^1.12.0`) that permitted resolution to the compromised version. Any user who performed a fresh install of `@lightdash/cli` versions `\u003e= 0.1800.0, \u003c 0.2695.1` (without a pre-existing lockfile) during this window may have installed the malicious axios version.\n\nIf compromised, the RAT establishes a connection to a command-and-control server (`sfrclak[.]com` / `142.11.206.73:8000`) and provides the attacker with shell access, file system enumeration, and the ability to execute arbitrary commands. All credentials, secrets, and tokens accessible from the affected machine should be considered compromised.\n\nLightdash Cloud is not affected.\n\n### Patches\n\nThis has been patched in `@lightdash/cli@0.2695.1`. The fix pins axios to a known safe version (1.14.0).\n\nUsers should upgrade immediately:\n\n```\nnpm install -g @lightdash/cli@0.2695.1\n```\n\nIf users had installed the compromised version, they should check for RAT artifacts before and after upgrading:\n\n- macOS: `/Library/Caches/com.apple.act.mond`\n- Windows: `%PROGRAMDATA%\\wt.exe`\n- Linux: `/tmp/ld.py`\n\nIf any artifacts are found, assume full compromise of that machine and rotate all accessible credentials (warehouse credentials, API tokens, SSH keys, cloud provider credentials, environment variables).\n\n### Workarounds\n\nIf users cannot upgrade immediately, they can force a safe axios resolution after installing the CLI:\n\n```\nnpm install -g axios@1.14.0 --force\n```\n\nAlternatively, if users are building a Docker image or using a lockfile, they should ensure their resolved axios version is not 1.14.1 or 0.30.4:\n\n```\nnpm ls axios\n```\n\nBlock egress traffic to `sfrclak[.]com` and `142.11.206.73` at the network level to prevent the RAT from reaching its command-and-control server.\n\n### Resources\n\n- Upstream axios issue: https://github.com/axios/axios/issues/10604\n- StepSecurity analysis: https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan\n- Socket analysis: https://socket.dev/blog/axios-npm-package-compromised\n- Snyk advisory (axios): https://security.snyk.io/vuln/SNYK-JS-AXIOS-15850650\n- Snyk advisory (plain-crypto-js): https://security.snyk.io/vuln/SNYK-JS-PLAINCRYPTOJS-15850652\n- The Hacker News coverage: https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html",
  "id": "GHSA-3hfp-gqgh-xc5g",
  "modified": "2026-04-02T18:36:10Z",
  "published": "2026-04-02T18:36:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lightdash/lightdash/security/advisories/GHSA-3hfp-gqgh-xc5g"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/issues/10604"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-fw8c-xr5c-95f9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lightdash/lightdash"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-AXIOS-15850650"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-PLAINCRYPTOJS-15850652"
    },
    {
      "type": "WEB",
      "url": "https://socket.dev/blog/axios-npm-package-compromised"
    },
    {
      "type": "WEB",
      "url": "https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html"
    },
    {
      "type": "WEB",
      "url": "https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.6.4"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "curl-cffi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.0b6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-22T18:15:17Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\ncurl_cffi is potentially affected by High Severity vulnerability (CVE-2023-38545) in libcurl\u003c8.4.0\n\n### Details\nHIGH severity vulnerability in curl and libcurl: [announcement](https://github.com/curl/curl/discussions/12026#discussioncomment-7195548)\nDetails are still unknown, but seems it will be a major issue as it\u0027s advertised by curl devs as \"_probably the worst curl security flaw in a long time_\".\nA patched version (8.4.0) and details will be published around 06:00 UTC on October 11.\ncurl_cffi wheels on PyPI ship with libcurl 7.84.0\n\n### PoC\n[https://inspector.pypi.io/project/curl-cffi/0.5.10b2/packages/56/ae/eb7d39ad234f1f44650b910757d5aa696feff413d327c8328223ce78cb76/curl_cffi-0.5.10b2-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl/curl_cffi/include/curl/curlver.h](https://inspector.pypi.io/project/curl-cffi/0.5.10b2/packages/56/ae/eb7d39ad234f1f44650b910757d5aa696feff413d327c8328223ce78cb76/curl_cffi-0.5.10b2-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl/curl_cffi/include/curl/curlver.h)\n\n### Resolution\n\nVersions after 0.7 bundles with `libcurl\u003e=8.5`, which is not affected by this issue.\n",
  "id": "GHSA-3vpc-4p9p-47hc",
  "modified": "2024-10-22T18:15:17Z",
  "published": "2024-10-22T18:15:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-3vpc-4p9p-47hc"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-7xw9-w465-6x42"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lexiforest/curl_cffi"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "curl_cffi bundles a version of libcurl affected by High Severity vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.42"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-beta3"
            },
            {
              "fixed": "3.6.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0-ea.1"
            },
            {
              "fixed": "3.7.0-ea.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-29T15:37:28Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThere is a potential vulnerability in Traefik due to its dependency on an affected version of gRPC-Go (CVE-2026-33186).\n\nA remote, unauthenticated attacker can send gRPC requests with a malformed HTTP/2 `:path` pseudo-header omitting the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server routes such requests correctly, path-based authorization interceptors evaluate the raw non-canonical path and fail to match \"deny\" rules, allowing the request to bypass the policy entirely if a fallback \"allow\" rule is present.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.42\n- https://github.com/traefik/traefik/releases/tag/v3.6.12\n- https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3\n\n## For more information\n\nIf there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n### Summary\nThis CVE hits traefik until Version 3.6.11 and 2.11.41.\ngRPC-Go has an authorization bypass via missing leading slash in :path\n### Details\nAs described in https://github.com/advisories/GHSA-p77j-4mvh-x3m3\n### PoC\nUpdate library version in \nhttps://github.com/traefik/traefik/blob/67c64ed9b25fbb90f1086977a62827133a7aa01b/go.mod#L108\n### Impact\nIs described in https://github.com/advisories/GHSA-p77j-4mvh-x3m3\n\n\u003c/details\u003e\n\n\n----------",
  "id": "GHSA-46wh-3698-f2cx",
  "modified": "2026-03-29T15:37:29Z",
  "published": "2026-03-29T15:37:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-46wh-3698-f2cx"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-p77j-4mvh-x3m3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/blob/67c64ed9b25fbb90f1086977a62827133a7aa01b/go.mod#L108"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.42"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.12"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pyrage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.0"
            },
            {
              "fixed": "1.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-56327"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-25",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-19T15:14:06Z",
    "nvd_published_at": "2024-12-19T23:15:07Z",
    "severity": "HIGH"
  },
  "details": "`pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w.\n\nAll details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details.\n\nVersions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**.\n\nAn equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory [GHSA-32gq-x56h-299c](https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c).\n\nThanks to \u2b21-49016 for reporting this issue.",
  "id": "GHSA-47h8-jmp3-9f28",
  "modified": "2024-12-20T18:35:12Z",
  "published": "2024-12-19T15:14:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/str4d/rage/security/advisories/GHSA-4fg7-vxc8-qx5w"
    },
    {
      "type": "WEB",
      "url": "https://github.com/woodruffw/pyrage/security/advisories/GHSA-47h8-jmp3-9f28"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56327"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-4fg7-vxc8-qx5w"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/woodruffw/pyrage"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution"
}