High
CVE-2025-22236
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 97
Reset filters
Medium
CVE-2024-38825
Salt's salt.auth.pki module does not properly authenticate callers
Medium
CVE-2023-34049
Salt preflight script could be attacker controlled
Medium
CVE-2024-22231
Directory creation by malicious user in saltstack
High
CVE-2024-22232
Path traversal in saltstack
High
CVE-2013-2228
SaltStack RSA Key Generation allows remote users to decrypt communications
Low
CVE-2026-6873
Django: signed cookies are vulnerable to salt namespace collisions
Critical
CVE-2026-29090
Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API
Critical
CVE-2026-29080
Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API
High
ghsa-69x8-hrgq-fjj8
LiteLLM: Password hash exposure and pass-the-hash authentication bypass
High
CVE-2026-33981
Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
High
CVE-2026-32609
Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials
Medium
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Critical
CVE-2024-38824
Salt vulnerable to directory traversal attack in file receiving method
Critical
CVE-2023-43791
Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens
High
CVE-2023-42443
Vyper vulnerable to memory corruption in certain builtins utilizing `msize`
Medium
CVE-2023-20897
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unrespons
High
CVE-2023-20898
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environ
Unrated
CVE-2021-33226
Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file.
Low
CVE-2022-31177
Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings
High
CVE-2022-22967
Salt's PAM auth fails to reject locked accounts
High
CVE-2021-25315
CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify
Critical
CVE-2021-3197
An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API re
Critical
CVE-2021-3144
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.