Security advisories

low2025-12-19

CVE-2025-14882-pretix has Broken Access Control Allowing Cross-User File Access via UUID

pretix/pretix · GHSA-pmjj-h5jm-vxh4

high2025-12-19

CVE-2025-66524-Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization

apache/nifi · GHSA-v4p2-2w39-mhrj

medium2025-12-19

CVE-2025-14546-FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation

tomasvotava/fastapi-sso · GHSA-hp6r-r9vc-q8wx

medium2025-12-19

CVE-2025-68384-Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User Settings Data

elastic/elasticsearch · GHSA-qf7c-7r9h-mm92

medium2025-12-19

CVE-2025-68390-Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation

elastic/elasticsearch · GHSA-gphj-4h6p-37xq

high2025-12-19

CVE-2025-68388-Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments

elastic/beats · GHSA-fj69-23m4-ccvv

medium2025-12-19

CVE-2025-68383-Filebeat Beats has Buffer Overflow via Malformed Syslog Message or Malicious Tokenizer Pattern in Dissect Configuration

elastic/elasticsearch · GHSA-2mj3-6grc-px38

critical2025-12-18

CVE-2025-68398-Weblate is vulnerable to RCE through Git config file overwrite

weblateorg/weblate · GHSA-8vcg-cfxj-p5m3

high2025-12-18

CVE-2025-68279-Weblate has an arbitrary file read via symbolic links

weblateorg/weblate · GHSA-g925-f788-4jh7

high2025-12-18

CVE-2025-53000-nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

jupyter/nbconvert · GHSA-xm59-rqc7-hhvf

medium2025-12-18

CVE-2025-68161-Apache Log4j does not verify the TLS hostname in its Socket Appender

apache/logging-log4j2 · GHSA-vc5p-v9hr-52mj

medium2025-12-18

CVE-2025-14761-AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue

aws/aws-sdk-php · GHSA-x8cp-jf6f-r4xh

medium2025-12-18

CVE-2025-14762-AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue

aws/aws-sdk-ruby · GHSA-2xgq-q749-89fq

medium2025-12-18

CVE-2025-14764-Amazon S3 Encryption Client has a Key Commitment Issue

aws/amazon-s3-encryption-client-go · GHSA-3g75-q268-r9r6

high2025-12-18

CVE-2025-68429-Storybook manager bundle may expose environment variables during build

storybookjs/storybook · GHSA-8452-54wp-rmv6

high2025-12-18

CVE-2025-68278-tinacms is vulnerable to arbitrary code execution

tinacms/tinacms · GHSA-529f-9qwm-9628

critical2025-12-18

CVE-2025-63389-Ollama Platform has missing authentication enabling attackers to perform model management operations

ollama/ollama · GHSA-f6mr-38g8-39rg

medium2025-12-18

CVE-2025-14763-Amazon S3 Encryption Client for Java has a Key Commitment Issue

aws/amazon-s3-encryption-client-java · GHSA-x44p-gvrj-pj2r

medium2025-12-18

CVE-2025-14759-Amazon S3 Encryption Client for .NET has a Key Commitment Issue

aws/amazon-s3-encryption-client-dotnet · GHSA-4v42-65r3-3gjx

medium2025-12-18

CVE-2025-68463-Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez

biopython/biopython · GHSA-x3vf-39hj-gxr4