Security advisories

medium2025-12-31

CVE-2025-68131-CBORDecoder reuse can leak shareable values across decode calls

agronholm/cbor2 · GHSA-wcj4-jw5j-44wh

medium2025-12-31

CVE-2025-69277-libsodium has Incomplete List of Disallowed Inputs

paragonie/sodium_compat · GHSA-mrfv-m5wm-5w6w

high2025-12-30

CVE-2025-69257-theshit vulnerable to unsafe loading of user-owned Python rules when running as root

asfhtgkdavid/theshit · GHSA-95qg-89c2-w5hj

medium2025-12-30

CVE-2025-68950-ImageMagick's failure to limit MVG mutual causes Stack Overflow

imagemagick/imagemagick · GHSA-7rvh-xqp3-pr8j

critical2025-12-30

CVE-2025-68926-RustFS has a gRPC Hardcoded Token Authentication Bypass

rustfs/rustfs · GHSA-h956-rh7x-ppgj

medium2025-12-30

CVE-2025-68618-ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack

imagemagick/imagemagick · GHSA-p27m-hp98-6637

low2025-12-30

CVE-2025-14986-Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts

temporalio/temporal · GHSA-p2gr-hm8g-q772

medium2025-12-30

CVE-2025-14987-Temporal has an Incorrect Authorization vulnerability

temporalio/temporal · GHSA-hmhp-gh8m-c8xp

low2025-12-30

CVE-2025-61594-URI Credential Leakage Bypass over CVE-2025-27221

ruby/uri · GHSA-j4pr-3wm6-xx2r

medium2025-12-30

CVE-2025-15284-qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

ljharb/qs · GHSA-6rw7-vpxm-498p

high2025-12-30

CVE-2025-69210-FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

neorazorx/facturascripts · GHSA-2267-xqcf-gw2m

high2025-12-30

YOURLS is vulnerable to XSS through JSONP and Callback request parameters

yourls/yourls · GHSA-6mp4-q625-mxjp

high2025-12-30

PsiTransfer has Zip Slip Path Traversal via TAR Archive Download

psi-4ward/psitransfer · GHSA-xphh-5v4r-r3rx

low2025-12-30

CVE-2025-67746-Composer is vulnerable to ANSI sequence injection

composer/composer · GHSA-59pp-r3rg-353g

medium2025-12-30

CVE-2025-69202-axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header

arthurfiorette/axios-cache-interceptor · GHSA-x4m5-4cw8-vc44

medium2025-12-30

CVE-2025-69211-Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

nestjs/nest · GHSA-8wpr-639p-ccrj

high2025-12-30

CVE-2025-69200-phpMyFAQ has unauthenticated config backup download via /api/setup/backup

thorsten/phpmyfaq · GHSA-9cg9-4h4f-j6fg

high2025-12-30

Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter

mmaitre314/picklescan · GHSA-46h3-79wf-xr6c

high2025-12-30

Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller

mmaitre314/picklescan · GHSA-955r-x9j8-7rhh

medium2025-12-30

CVE-2025-71339-Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length

mmaitre314/picklescan · GHSA-6556-fwc2-fg2p