Security advisories

medium2025-12-23

CVE-2025-65713-Home Assistant Core before is vulnerable to Directory Traversal

home-assistant/core · GHSA-pp3g-xmm4-5cw9

medium2025-12-23

CVE-2025-68614-LibreNMS Alert Rule API Cross-Site Scripting Vulnerability

librenms/librenms · GHSA-c89f-8g7g-59wj

medium2025-12-23

CVE-2025-67743-Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

learningcircuit/local-deep-research · GHSA-9c54-gxh7-ppjc

high2025-12-22

CVE-2025-68475-Fedify has ReDoS Vulnerability in HTML Parsing Regex

fedify-dev/fedify · GHSA-rchf-xwx2-hm93

low2025-12-22

CVE-2025-67290-Piranha has stored cross-site scripting (XSS) vulnerability

piranhacms/piranha.core · GHSA-fw48-7qf9-455m

low2025-12-22

CVE-2025-67291-Piranha has stored cross-site scripting (XSS) vulnerability

piranhacms/piranha.core · GHSA-83fp-hh9m-c2jq

medium2025-12-22

CVE-2025-67288-Umbraco CMS has an arbitrary file upload vulnerability

umbraco/umbraco-cms · GHSA-54mj-vcvj-q3v5

medium2025-12-22

CVE-2025-68480-Marshmallow has DoS in Schema.load(many)

marshmallow-code/marshmallow · GHSA-428g-f7cq-pgp5

high2025-12-22

CVE-2025-68476-KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

kedacore/keda · GHSA-c4p6-qg4m-9jmr

critical2025-12-22

CVE-2025-68613-n8n Vulnerable to Remote Code Execution via Expression Injection

n8n-io/n8n · GHSA-v98v-ff95-f3cp

high2025-12-22

CVE-2025-14273-Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm

mattermost/mattermost · GHSA-qvmc-92vg-6r35

medium2025-12-20

CVE-2025-34469-Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification

cowrie/cowrie · GHSA-83jg-m2pm-4jxj

high2025-12-19

CVE-2025-68478-External Control of File Name or Path in Langflow

langflow-ai/langflow · GHSA-f43r-cc68-gpx4

high2025-12-19

CVE-2025-68477-Langflow vulnerable to Server-Side Request Forgery

langflow-ai/langflow · GHSA-5993-7p27-66g5

low2025-12-19

Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature

tutao/tutanota · GHSA-24v3-254g-jv85

medium2025-12-19

CVE-2025-13467-Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization

keycloak/keycloak · GHSA-4hx9-48xh-5mxr

high2025-12-19

CVE-2023-53957-Kimai contains a SameSite cookie vulnerability

kimai/kimai · GHSA-cv8h-r7r5-vwj9

medium2025-12-19

CVE-2025-68481-FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

fastapi-users/fastapi-users · GHSA-5j53-63w8-8625

low2025-12-19

CVE-2025-68457-Orejime has executable code in HTML attributes

boscop-fr/orejime · GHSA-72mh-hgpm-6384

low2025-12-19

CVE-2025-14881-pretix has Broken Access Control Allowing Cross-User File Access via UUID

pretix/pretix · GHSA-r2h2-g46h-8mx8