deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-r6j8-c6r2-37rr
Package: k8s.io/kubernetes (GO)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 1.34.0-alpha.0, < 1.34.2
Patched in: 1.34.2

Summary: kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

Details:
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
GitHub Security Advisory: GHSA-r6j8-c6r2-37rr
Package: k8s.io/kubernetes (GO)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 1.33.0-alpha.0, < 1.33.6
Patched in: 1.33.6

Summary: kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

Details:
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
GitHub Security Advisory: GHSA-r6j8-c6r2-37rr
Package: k8s.io/kubernetes (GO)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 1.32.10
Patched in: 1.32.10

Summary: kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

Details:
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
GitHub Security Advisory: GHSA-6gvq-jcmp-8959
Package: github.com/altcha-org/altcha-lib-go (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-115: Misinterpretation of Input, CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 1.0.0
Patched in: 1.0.0

Summary: ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Details:
### Impact

A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions.

The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. 

### Patches

This issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation.

Users are advised to upgrade to patched versions.

### Workarounds

As a mitigation, implementations may append a delimiter to the end of the `salt` value prior to HMAC computation (for example, `<salt>?expires=<time>&`). This prevents ambiguity between parameters and the nonce and is backward-compatible with existing implementations, as the delimiter is treated as a standard URL parameter separator.
GitHub Security Advisory: GHSA-7v39-2hx7-7c43
Package: github.com/weaviate/weaviate (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-61: UNIX Symbolic Link (Symlink) Following
Vulnerable versions: >= 1.33.0-rc.0, < 1.33.4
Patched in: 1.33.4

Summary: Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip

Details:
An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application's privilege scope.
GitHub Security Advisory: GHSA-7v39-2hx7-7c43
Package: github.com/weaviate/weaviate (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-61: UNIX Symbolic Link (Symlink) Following
Vulnerable versions: >= 1.32.0-rc.0, < 1.32.16
Patched in: 1.32.16

Summary: Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip

Details:
An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application's privilege scope.
GitHub Security Advisory: GHSA-7v39-2hx7-7c43
Package: github.com/weaviate/weaviate (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-61: UNIX Symbolic Link (Symlink) Following
Vulnerable versions: >= 1.31.0-rc.0, < 1.31.19
Patched in: 1.31.19

Summary: Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip

Details:
An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application's privilege scope.
GitHub Security Advisory: GHSA-7v39-2hx7-7c43
Package: github.com/weaviate/weaviate (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-61: UNIX Symbolic Link (Symlink) Following
Vulnerable versions: < 1.30.20
Patched in: 1.30.20

Summary: Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip

Details:
An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application's privilege scope.
GitHub Security Advisory: GHSA-hmmh-292h-3364
Package: github.com/weaviate/weaviate (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 1.33.0-rc.0, < 1.33.4
Patched in: 1.33.4

Summary: Weaviate OSS has path traversal vulnerability via the Shard Movement API

Details:
An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.
GitHub Security Advisory: GHSA-hmmh-292h-3364
Package: github.com/weaviate/weaviate (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 1.32.0-rc.0, < 1.32.16
Patched in: 1.32.16

Summary: Weaviate OSS has path traversal vulnerability via the Shard Movement API

Details:
An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.
GitHub Security Advisory: GHSA-hmmh-292h-3364
Package: github.com/weaviate/weaviate (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 1.31.0-rc.0, < 1.31.19
Patched in: 1.31.19

Summary: Weaviate OSS has path traversal vulnerability via the Shard Movement API

Details:
An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.
GitHub Security Advisory: GHSA-hmmh-292h-3364
Package: github.com/weaviate/weaviate (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 1.30.0, < 1.30.20
Patched in: 1.30.20

Summary: Weaviate OSS has path traversal vulnerability via the Shard Movement API

Details:
An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.
GitHub Security Advisory: GHSA-4jj9-cgqc-x9h5
Package: github.com/neuvector/neuvector (GO)
Severity: HIGH (CVSS 8.8)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 5.3.0, < 5.4.8
Patched in: 5.4.8

Summary: NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)

Details:
### Impact

NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.
Starting from version 5.4.0, NeuVector supports TLS verification for following connection types:

- Registry Connections
- Auth Server Connections (SAML, LDAP and OIDC)
- Webhook Connections

By default, TLS verification remains disabled, and its configuration is located under **Settings > Configuration in the NeuVector UI**.

In the patched version, the new NeuVector deployment enables TLS verification by default. 
For rolling upgrades, NeuVector does not automatically change this setting to prevent disruptions.

**Note:** When "TLS verification" is enabled, it affects all connections to:

- Registry servers
- Auth servers (SAML, LDAP and OIDC)
- Webhook servers

### Patches

Patched versions include release v5.4.8 and above.

### Workarounds

To manually enable TLS verification:

1. Open the NeuVector UI.
2. Navigate to **Settings > Configuration**.
3. In the **TLS Self-Signed Certificate Configuration** section, select **Enable TLS verification**.
4. (Optional) Upload or paste the **TLS self-signed certificate**.

### References

If you have any questions or comments about this advisory:

- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).
GitHub Security Advisory: GHSA-rwvp-r38j-9rgg
Package: github.com/nwaples/rardecode (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: <= 1.1.3
Patched in: unpatched

Summary: rardecode: DoS risk due to unrestricted RAR dictionary sizes

Details:
rardecode versions <= 2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.
GitHub Security Advisory: GHSA-fw33-qpx7-rhx2
Package: github.com/gardener/gardenctl-v2 (GO)
Severity: HIGH (CVSS 8.0)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: < 0.0.0[PII_REDACTED]1549-0bdc484cb5fb
Patched in: 0.0.0[PII_REDACTED]1549-0bdc484cb5fb

Summary: gardenctl is vulnerable to Command Injection when used with non‑POSIX shells

Details:
A security vulnerability was discovered in [gardenctl](https://github.com/gardener/gardenctl-v2) when it is used with non‑POSIX shells such as **[Fish](https://fishshell.com/)** and **[PowerShell](https://learn.microsoft.com/en-us/powershell/)**. Such setup could allow an attacker with administrative privileges for a Gardener project to craft malicious credential values in infrastructure Secret objects that break out of the intended string context when evaluated in Fish or PowerShell environments used by the Gardener service operators, leading to arbitrary command execution on the operator's device.

**Am I vulnerable?**
This CVE affects all Gardener operators who use  **gardenctl < v2.12.0** with non‑POSIX shells such as **[Fish](https://fishshell.com/)** and **[PowerShell](https://learn.microsoft.com/en-us/powershell/)**.
GitHub Security Advisory: GHSA-5xpq-2vmc-5cqp
Package: github.com/1Panel-dev/1Panel (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 1.10.33, <= 2.0.15
Patched in: unpatched

Summary: 1Panel contains a cross-site request forgery (CSRF) vulnerability in the panel name management functionality

Details:
1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a panel-name change request; if a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows a remote attacker to change the victim’s panel name to an arbitrary value without consent.
GitHub Security Advisory: GHSA-wrvc-x3wf-j5f5
Package: github.com/1Panel-dev/1Panel (GO)
Severity: HIGH (CVSS 7.1)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 1.10.33, <= 2.0.15
Patched in: unpatched

Summary: 1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality

Details:
1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoint lacks CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a port-change request; when a victim visits it while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the port on which the 1Panel web service listens, causing loss of access on the original port and resulting in service disruption or denial of service, and may unintentionally expose the service on an attacker-chosen port.
GitHub Security Advisory: GHSA-rpr2-4hqj-hc4q
Package: github.com/1Panel-dev/1Panel (GO)
Severity: HIGH (CVSS 7.1)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 1.10.33, <= 2.0.15
Patched in: unpatched

Summary: 1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username functionality

Details:
1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel). The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a username-change request; when a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the victim’s 1Panel username without consent. After the change, the victim is logged out and unable to log in with the previous username, resulting in account lockout and denial of service.
GitHub Security Advisory: GHSA-8jqm-8qm3-qgqm
Package: github.com/xyproto/algernon (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.17.5
Patched in: 1.17.5

Summary: Algernon Cross-Site Scripting vulnerability

Details:
Cross-site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filename.
GitHub Security Advisory: GHSA-f4cf-9rvr-2rcx
Package: github.com/zitadel/zitadel (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Vulnerable versions: < 1.80.0-v2.20.0[PII_REDACTED]1356-826039c6208f
Patched in: 1.80.0-v2.20.0[PII_REDACTED]1356-826039c6208f

Summary: Zitadel Discloses the Total Number of Instance Users

Details:
### Summary

Zitadel's User Service discloses the total number of instance users to unauthorized users.

### Impact

The ZITADEL User Service exposes the total number of users within an instance to any authenticated user, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the `totalResult` field constitutes an information disclosure vulnerability that may be sensitive in certain contexts.

### Affected Versions

Systems running one of the following version are affected:

- **4.x**: `4.0.0-rc.1` through `4.7.1`
- **3.x**: `3.0.0-rc.1` through `3.4.4`
- **2.x**: `2.44.0` through `2.71.19`

### Patches

The vulnerability has been addressed in the latest release. The patch resolves the issue and returns the `totalResult` value corresponding to the number of instance users for whom the querying user has read permission.

- 4.x: Upgrade to >= [4.7.2](https://github.com/zitadel/zitadel/releases/tag/v4.7.2)
- 3.x: Update to >= [3.4.5](https://github.com/zitadel/zitadel/releases/tag/v3.4.5)
- 2.x: Update to >= [3.4.5](https://github.com/zitadel/zitadel/releases/tag/v3.4.5) (or checkout the workarounds section)

### Workarounds

The recommended solution is to update Zitadel to a patched version.

If a version upgrade is not possible, you can enable the `permissionCheckV2` feature on your instance.

### Questions

If you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)

### Credits

This vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.
The full report will be made public after the complete review.
GitHub Security Advisory: GHSA-f4cf-9rvr-2rcx
Package: github.com/zitadel/zitadel (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Vulnerable versions: >= 2.44.0, <= 3.4.4
Patched in: 3.4.5

Summary: Zitadel Discloses the Total Number of Instance Users

Details:
### Summary

Zitadel's User Service discloses the total number of instance users to unauthorized users.

### Impact

The ZITADEL User Service exposes the total number of users within an instance to any authenticated user, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the `totalResult` field constitutes an information disclosure vulnerability that may be sensitive in certain contexts.

### Affected Versions

Systems running one of the following version are affected:

- **4.x**: `4.0.0-rc.1` through `4.7.1`
- **3.x**: `3.0.0-rc.1` through `3.4.4`
- **2.x**: `2.44.0` through `2.71.19`

### Patches

The vulnerability has been addressed in the latest release. The patch resolves the issue and returns the `totalResult` value corresponding to the number of instance users for whom the querying user has read permission.

- 4.x: Upgrade to >= [4.7.2](https://github.com/zitadel/zitadel/releases/tag/v4.7.2)
- 3.x: Update to >= [3.4.5](https://github.com/zitadel/zitadel/releases/tag/v3.4.5)
- 2.x: Update to >= [3.4.5](https://github.com/zitadel/zitadel/releases/tag/v3.4.5) (or checkout the workarounds section)

### Workarounds

The recommended solution is to update Zitadel to a patched version.

If a version upgrade is not possible, you can enable the `permissionCheckV2` feature on your instance.

### Questions

If you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)

### Credits

This vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.
The full report will be made public after the complete review.
GitHub Security Advisory: GHSA-f4cf-9rvr-2rcx
Package: github.com/zitadel/zitadel (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Vulnerable versions: >= 4.0.0-rc.1, <= 4.7.1
Patched in: 4.7.2

Summary: Zitadel Discloses the Total Number of Instance Users

Details:
### Summary

Zitadel's User Service discloses the total number of instance users to unauthorized users.

### Impact

The ZITADEL User Service exposes the total number of users within an instance to any authenticated user, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the `totalResult` field constitutes an information disclosure vulnerability that may be sensitive in certain contexts.

### Affected Versions

Systems running one of the following version are affected:

- **4.x**: `4.0.0-rc.1` through `4.7.1`
- **3.x**: `3.0.0-rc.1` through `3.4.4`
- **2.x**: `2.44.0` through `2.71.19`

### Patches

The vulnerability has been addressed in the latest release. The patch resolves the issue and returns the `totalResult` value corresponding to the number of instance users for whom the querying user has read permission.

- 4.x: Upgrade to >= [4.7.2](https://github.com/zitadel/zitadel/releases/tag/v4.7.2)
- 3.x: Update to >= [3.4.5](https://github.com/zitadel/zitadel/releases/tag/v3.4.5)
- 2.x: Update to >= [3.4.5](https://github.com/zitadel/zitadel/releases/tag/v3.4.5) (or checkout the workarounds section)

### Workarounds

The recommended solution is to update Zitadel to a patched version.

If a version upgrade is not possible, you can enable the `permissionCheckV2` feature on your instance.

### Questions

If you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)

### Credits

This vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.
The full report will be made public after the complete review.
GitHub Security Advisory: GHSA-mq8m-42gh-wq7r
Package: gogs.io/gogs (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 0.13.3
Patched in: unpatched

Summary: Gogs vulnerable to a bypass of CVE-2024-55947

Details:
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.