Security advisories

critical2025-12-26

CVE-2025-68668-n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node

n8n-io/n8n · GHSA-62r4-hw23-cc8v

high2025-12-26

CVE-2025-67729-lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()

internlm/lmdeploy · GHSA-9pf3-7rrr-x5jh

high2025-12-26

CVE-2025-61914-n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox

n8n-io/n8n · GHSA-58jc-rcg5-95f3

high2025-12-26

CVE-2025-25341-libxmljs has segmentation fault, potentially leading to a denial-of-service (DoS)

libxmljs/libxmljs · GHSA-jv72-59wq-8rxm

medium2025-12-26

CVE-2025-68943-Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order

go-gitea/gitea · GHSA-jhx5-4vr4-f327

medium2025-12-26

CVE-2025-68946-Gitea vulnerable to Cross-site Scripting

go-gitea/gitea · GHSA-hq57-c72x-4774

medium2025-12-26

CVE-2025-68944-Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries

go-gitea/gitea · GHSA-f85h-c7m6-cfpm

medium2025-12-26

CVE-2025-68945-Gitea: anonymous user can visit private user's project

go-gitea/gitea · GHSA-7xq4-mwcp-q8fx

medium2025-12-26

CVE-2025-68942-Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text

go-gitea/gitea · GHSA-898p-hh3p-hf9r

medium2025-12-26

CVE-2025-68941-Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources

go-gitea/gitea · GHSA-xfq3-qj7j-4565

low2025-12-26

CVE-2025-68940-Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.

go-gitea/gitea · GHSA-rrcw-5rjv-vj26

medium2025-12-26

CVE-2025-68938-Gitea mishandles authorization for deletion of releases

go-gitea/gitea · GHSA-cm54-pfmc-xrwx

high2025-12-26

CVE-2025-68939-Gitea allows attackers to add attachments with forbidden file extensions

go-gitea/gitea · GHSA-263q-5cv3-xq9g

medium2025-12-24

CVE-2025-64641-Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin

mattermost/mattermost · GHSA-vww6-79rv-3j4x

medium2025-12-24

CVE-2025-13767-Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues

mattermost/mattermost · GHSA-fmqf-pmcm-8cx9

critical2025-12-23

CVE-2025-14931-Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE

huggingface/smolagents · GHSA-q9r5-6hrr-9ph7

high2025-12-23

CVE-2025-68665-LangChain serialization injection vulnerability enables secret extraction

langchain-ai/langchainjs · GHSA-r399-636x-v7f6

high2025-12-23

CVE-2025-68696-httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

jnunemaker/httparty · GHSA-hm5p-x4rq-38w4

critical2025-12-23

CVE-2025-68664-LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

langchain-ai/langchain · GHSA-c67j-w6g6-q2cm

high2025-12-23

CVE-2025-51511-Cadmium CMS has a background arbitrary file upload vulnerability

cadmium-org/cadmium-cms · GHSA-qx44-p258-3c2v