Security advisories

medium2025-12-17

CVE-2025-68143-mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

modelcontextprotocol/servers · GHSA-5cgr-j3jf-jw3v

critical2025-12-17

CVE-2025-67165-Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component

pagekit/pagekit · GHSA-w3j8-9p3j-3wjx

critical2025-12-17

CVE-2025-67164-Pagekit CMS is vulnerable to OS Command Injection via Storage component

pagekit/pagekit · GHSA-m4f2-xpfq-h97v

low2025-12-17

CVE-2025-62690-Mattermost has missing redirect URL validation

mattermost/mattermost · GHSA-q66g-q98c-q454

low2025-12-17

CVE-2025-13352-Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection

mattermost/mattermost · GHSA-jf5h-xfw4-p8gp

medium2025-12-17

CVE-2025-62190-Mattermost has CSRF vulnerability via Calls Widget page

mattermost/mattermost-plugin-calls · GHSA-gmx5-frv9-9m9f

critical2025-12-17

CVE-2025-67895-Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context

apache/airflow · GHSA-66h8-3g48-6hx8

high2025-12-16

CVE-2025-68154-systeminformation has a Command Injection vulnerability in fsSize() function on Windows

sebhildebrandt/systeminformation · GHSA-wphj-fx3q-84ch

high2025-12-16

CVE-2025-68150-Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter

parse-community/parse-server · GHSA-3f5f-xgrj-97pf

high2025-12-16

CVE-2025-68156-Expr has Denial of Service via Unbounded Recursion in Builtin Functions

expr-lang/expr · GHSA-cfpf-hrx2-8rv6

high2025-12-16

CVE-2025-68155-@vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint

vitejs/vite-plugin-react · GHSA-g239-q96q-x4qm

high2025-12-16

CVE-2025-68274-SIPGO is Vulnerable to Response DoS via Nil Pointer Dereference

emiago/sipgo · GHSA-c623-f998-8hhv

high2025-12-16

Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits

better-auth/better-auth · GHSA-x732-6j76-qmhm

medium2025-12-16

CVE-2025-68146-filelock has a TOCTOU race condition which allows symlink attacks during lock file creation

tox-dev/filelock · GHSA-w853-jp5j-5j7f

low2025-12-16

CVE-2025-68142-PyMdown Extensions has a ReDOS bug in its Figure Capture extension

facelessuser/pymdown-extensions · GHSA-r6h4-mm7h-8pmq

high2025-12-16

CVE-2025-68927-Libredesk has Improper Neutralization of HTML Tags in a Web Page

abhinavxd/libredesk · GHSA-wh6m-h6f4-rjf4

high2025-12-16

CVE-2025-68130-tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

trpc/trpc · GHSA-43p4-m455-4f4j

medium2025-12-16

CVE-2025-68115-Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables

parse-community/parse-server · GHSA-jhgf-2h8h-ggxv

medium2025-12-16

CVE-2025-65581-ABP Account Module has an Open Redirect through Improper validation in its register function

abpframework/abp · GHSA-vfm5-cr22-jg3m

high2025-12-16

CVE-2025-14443-openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References

openshift/openshift-apiserver · GHSA-gxvv-45f6-3ch8