GHSA-j4rc-96xj-gvqc: phpMyFAQ: Public API endpoints expose emails and invisible questions

GHSA-wm8h-26fv-mg7g: phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)

GHSA-7p9h-m7m8-vhhv: phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

GHSA-w7rq-fgx4-4xcm: LavaLite CMS affected by a stored cross-site scripting vulnerability

GHSA-mxc8-4jqf-368q: miniserve affected by a TOCTOU and symlink race vulnerability

Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0

**PaddlePaddle command injection in paddle.utils.download.\_wget\_download**

Critical severity GitHub Reviewed Published Mar 7, 2024 to the GitHub Advisory Database • Updated Mar 7, 2024

Headline

GHSA-qqv2-35q8-p2g2: PaddlePaddle command injection in paddle.utils.download._wget_download

ghsa: Latest News