Security advisories

medium2025-12-16

CVE-2025-68113-ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

altcha-org/altcha-lib · GHSA-6gvq-jcmp-8959

high2025-12-15

CVE-2025-67748-Fickling has Code Injection vulnerability via pty.spawn()

trailofbits/fickling · GHSA-r7v6-mfhq-g3m2

high2025-12-15

CVE-2025-67747-Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list

trailofbits/fickling · GHSA-565g-hwwr-4pp3

medium2025-12-15

CVE-2025-67735-Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

netty/netty · GHSA-84h7-rjj3-6jx4

medium2025-12-15

CVE-2025-67715-Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)

weblateorg/weblate · GHSA-3pmh-24wp-xpf4

medium2025-12-15

CVE-2025-67492-Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration

weblateorg/weblate · GHSA-pj86-258h-qrvf

medium2025-12-15

CVE-2025-66482-Misskey has a login rate limit bypass via spoofed X-Forwarded-For header

misskey-dev/misskey · GHSA-wwrj-3hvj-prpm

high2025-12-15

CVE-2025-66402-misskey.js's export data contains private post data

misskey-dev/misskey · GHSA-496g-mmpw-j9x3

low2025-12-15

CVE-2025-64725-Weblate has improper validation upon invitation acceptance

weblateorg/weblate · GHSA-m6hq-f4w9-qrjj

high2025-12-15

CVE-2025-11393-Misconfigured Internal Proxy in runtimes-inventory-rhel8-operator Grants Standard Users Full Cluster Administrator Access

redhatinsights/runtimes-inventory-operator · GHSA-cc8c-28gj-px38

critical2025-12-15

CVE-2025-13888-OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources

redhat-developer/gitops-operator · GHSA-pcqx-8qww-7f4v

medium2025-12-15

CVE-2025-66843-Grav is vulnerable to Stored XSS through authenticated user-edited content

getgrav/grav · GHSA-mh85-44c2-3m97

critical2025-12-15

CVE-2025-66844-Grav may be vulnerable to SSRF attack via Twig Templates

getgrav/grav · GHSA-729w-j79f-2c34

medium2025-12-15

CVE-2025-37731-Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

elastic/elasticsearch · GHSA-m9gh-789g-q5pv

medium2025-12-15

CVE-2025-66388-Apache Airflow exposes secret values to authenticated UI users via rendered templates

apache/airflow · GHSA-fv47-pqh6-wxgq

medium2025-12-15

CVE-2025-13281-kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

kubernetes/kubernetes · GHSA-r6j8-c6r2-37rr

low2025-12-15

CVE-2025-14691-Mayan EDMS is vulnerable to XSS through the /authentication/ file

mayan-edms/mayan-edms · GHSA-774q-r975-vqwp

medium2025-12-15

CVE-2025-67898-MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

mjmlio/mjml · GHSA-45h5-66jx-r2wf

medium2025-12-14

CVE-2025-14674-snail-job is vulnerable to Code Injection through QLExpressEngine.doEval function

aizuda/snail-job · GHSA-3f8c-8h8v-p54h

high2025-12-13

CVE-2025-14542-Universal Tool Calling Protocol (UTCP) client library for Python vulnerable to Trust Boundary Violation through Manual JSON specification

universal-tool-calling-protocol/python-utcp · GHSA-75mj-4g74-9rg2