Aikido Vulnerability Database

@backstage/backend-defaults is vulnerable to Accidental exposure of sensitive info possible in versions 0.1.0 - 0.5.0.

@syncfusion/ej2-documenteditor is vulnerable to Cross-site Scripting (XSS) in versions 26.2.4 - 27.1.52.

mysql-connector-python is vulnerable to SQL Injection in versions 8.3.0 - 9.0.0.

github.com/hashicorp/consul is vulnerable to Cross-site Scripting (XSS) in versions 1.9.0 - 1.19.2.

datadog/dd-trace is vulnerable to DoS possible due to memory leak or race condition in versions 0.1.0 - 1.3.2.

libarchive.libarchive is vulnerable to DoS possible due to improper check for exceptional conditions in versions 3.0.0a - 3.7.6.

http-server is vulnerable to Selection of Less-Secure Algorithm During Negotiation in versions 200 - 274.

@clerk/clerk-js is vulnerable to URL Redirection to Untrusted Site ('Open Redirect') in versions 2.13.1 - 5.26.3.

astro is vulnerable to Cross-site Scripting (XSS) in versions 3.2.0 - 4.16.0.

api-platform/core is vulnerable to Missing Authorization in versions 4.0.0 - 4.0.2.

kedro is vulnerable to Remote Code Execution (RCE) in versions 0.18.4 - 0.19.8.

torchgeo is vulnerable to Command Injection in versions 0.4.0 - 0.6.0.

gevent is vulnerable to Race Condition in versions 1.2.0 - 24.10.0.

markdown2 is vulnerable to Cross-site Scripting in versions 1.0.0 - 2.5.0.

deepspeed is vulnerable to Command Injection in versions 0.1.0 - 0.15.1.

n8n is vulnerable to Relative Path Traversal in versions 1.0.0 - 1.62.3.

craftcms/cms is vulnerable to Incorrect Authorization in versions 4.0.0 - 4.12.5 and 5.0.0 - 5.4.6.

oauth4webapi is vulnerable to Cleartext Transmission of Sensitive Information in versions 0.0.1 - 2.17.0.