Security advisories

medium2025-12-11

CVE-2025-55183-Source Code Exposure Vulnerability in React Server Components

facebook/react · GHSA-925w-6v3x-g4j4

critical2025-12-11

CVE-2025-13780-pgadmin4 has a Meta-Command Filter Command Execution

pgadmin-org/pgadmin4 · GHSA-fxmw-jcgr-w44v

high2025-12-11

CVE-2025-67731-Servify-express rate limit issue

aarondoran/servify-express · GHSA-qgc4-8p88-4w7m

low2025-12-11

CVE-2025-67737-AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE

azuracast/azuracast · GHSA-9449-rphm-mjqr

high2025-12-11

CVE-2025-67508-gardenctl is vulnerable to Command Injection when used with non‑POSIX shells

gardener/gardenctl-v2 · GHSA-fw33-qpx7-rhx2

medium2025-12-11

CVE-2025-64702-quic-go HTTP/3 QPACK Header Expansion DoS

quic-go/quic-go · GHSA-g754-hx8w-x2g6

medium2025-12-11

CVE-2025-14518- PowerJob has a server-side request forgery vulnerability in PingPongUtils.java

powerjob/powerjob · GHSA-8xqm-6fj2-hfgf

low2025-12-10

CVE-2025-67716-Improper Validation of Query Parameters in Auth0 Next.js SDK

auth0/nextjs-auth0 · GHSA-mr6f-h57v-rpj5

high2025-12-10

CVE-2025-67505-Race condition in the Okta Java SDK

okta/okta-sdk-java · GHSA-j5gq-897m-2rff

high2025-12-10

CVE-2025-34429-1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality

1panel-dev/1panel · GHSA-wrvc-x3wf-j5f5

medium2025-12-10

CVE-2025-34430-1Panel contains a cross-site request forgery (CSRF) vulnerability in the panel name management functionality

1panel-dev/1panel · GHSA-5xpq-2vmc-5cqp

medium2025-12-10

CVE-2025-67490-Improper Request Caching Lookup in the Auth0 Next.js SDK

auth0/nextjs-auth0 · GHSA-wcgj-f865-c7j7

medium2025-12-10

CVE-2025-66033-Improper Memory Cleanup in the Okta Java SDK

okta/okta-sdk-java · GHSA-qhr6-6cgv-6638

medium2025-12-10

CVE-2025-67720-Pyrofork has a Path Traversal in download_media Method

mayuri-chan/pyrofork · GHSA-6h2f-wjhf-4wjx

high2025-12-10

CVE-2025-67718-Formio improperly authorized permission elevation through specially crafted request path

formio/formio · GHSA-m654-769v-qjv7

high2025-12-10

CVE-2025-67641-Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability

jenkinsci/coverage-plugin · GHSA-v3f3-rf6r-43x5

medium2025-12-10

CVE-2025-67643-Jenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability

jenkinsci/pipeline-reporter-by-redpen-plugin · GHSA-qxh4-j39m-qfx4

medium2025-12-10

CVE-2025-65754-Algernon Cross-Site Scripting vulnerability

xyproto/algernon · GHSA-8jqm-8qm3-qgqm

medium2025-12-10

CVE-2025-67642-Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials

jenkinsci/hashicorp-vault-plugin · GHSA-3fm2-hx3h-xm4v

medium2025-12-10

CVE-2025-67640-Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin

jenkinsci/git-client-plugin · GHSA-v8hg-m323-jvjq