Security advisories

high2025-12-30

Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef

mmaitre314/picklescan · GHSA-rrxm-2pvv-m66x

low2025-12-30

Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”

pterodactyl/panel · GHSA-mgr9-6c2j-jxrq

medium2025-12-30

CVE-2025-68120-Visual Studio Code Go extension has unexpected untrusted code execution

golang/vscode-go · GHSA-fjmr-7667-8v4p

medium2025-12-29

Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.param_eval

mmaitre314/picklescan · GHSA-cffc-mxrf-mhh4

medium2025-12-29

CVE-2025-68951-phpMyFAQ has Stored XSS in user list via admin-managed display_name

thorsten/phpmyfaq · GHSA-jv8r-hv7q-p6vc

medium2025-12-29

CVE-2025-69206-hemmelig allows SSRF Filter bypass via Secret Request functionality

hemmeligorg/hemmelig.app · GHSA-vvxf-wj5w-6gj5

high2025-12-29

CVE-2025-71365-Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval

mmaitre314/picklescan · GHSA-3329-ghmp-jmv5

high2025-12-29

Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller

mmaitre314/picklescan · GHSA-x843-g5mx-g377

high2025-12-29

Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef

mmaitre314/picklescan · GHSA-r8g5-cgf2-4m4m

high2025-12-29

CVE-2025-71322-Picklescan Bypasses Unsafe Globals Check using pty.spawn

mmaitre314/picklescan · GHSA-hgrh-qx5j-jfwx

high2025-12-29

Picklescan missing detection when calling pty.spawn

mmaitre314/picklescan · GHSA-vqmv-47xg-9wpr

high2025-12-29

CVE-2025-71320-Picklescan has Incomplete List of Disallowed Inputs

mmaitre314/picklescan · GHSA-84r2-jw7c-4r5q

high2025-12-29

CVE-2025-71323-Picklescan does not block ctypes

mmaitre314/picklescan · GHSA-4675-36f9-wf6r

high2025-12-29

CVE-2025-71321-Picklescan vulnerable to Arbitrary File Writing

mmaitre314/picklescan · GHSA-m273-6v24-x4m4

low2025-12-27

CVE-2025-15107-SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key

actiontech/sqle · GHSA-43h9-hc38-qph5

high2025-12-26

FastMCP updated to MCP 1.23+ due to CVE-2025-66416

jlowin/fastmcp · GHSA-rcfx-77hg-w2wv

medium2025-12-26

ruint affected by unsoundness of safe `reciprocal_mg10`

recmo/uint · GHSA-9fjq-45qv-pcm7

high2025-12-26

CVE-2024-42718-Croogo CMS has a path traversal vulnerability

croogo/croogo · GHSA-g5p6-3j82-xfm4

critical2025-12-26

CVE-2025-13158-apidoc-core has a prototype pollution vulnerability

apidoc/apidoc-core · GHSA-6vj3-p34w-xxjp

high2025-12-26

CVE-2025-68697-Self-hosted n8n has Legacy Code node that enables arbitrary file read/write

n8n-io/n8n · GHSA-j4p8-h8mh-rh8q