Security advisories

low2025-12-10

CVE-2025-67639-Jenkins has a CSRF vulnerability on the login form

jenkinsci/jenkins · GHSA-6837-qgrc-x5p6

high2025-12-10

CVE-2025-34410-1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username functionality

1panel-dev/1panel · GHSA-rpr2-4hqj-hc4q

critical2025-12-10

CVE-2025-67719-Ibexa User Bundle is missing password change validation

ibexa/user · GHSA-x93p-w2ch-fg67

medium2025-12-10

CVE-2025-67717-Zitadel Discloses the Total Number of Instance Users

zitadel/zitadel · GHSA-f4cf-9rvr-2rcx

medium2025-12-10

CVE-2025-67713-Miniflux has an Open Redirect via protocol-relative redirect_url

miniflux/v2 · GHSA-wqv2-4wpg-8hc9

high2025-12-10

CVE-2025-66628-ImageMagick is vulnerable to an integer Overflow in TIM decoder leading to out of bounds read (32-bit only)

imagemagick/imagemagick · GHSA-6hjr-v6g4-3fm8

high2025-12-10

CVE-2025-66474-XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

xwiki/xwiki-rendering · GHSA-9xc6-c2rm-f27p

high2025-12-10

CVE-2025-66473-XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis

xwiki/xwiki-platform · GHSA-cc84-q3v3-mhgf

medium2025-12-10

CVE-2025-66472-XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

xwiki/xwiki-platform · GHSA-7vpr-jm38-wr7w

high2025-12-10

CVE-2025-8110-Gogs vulnerable to a bypass of CVE-2024-55947

gogs/gogs · GHSA-mq8m-42gh-wq7r

high2025-12-10

CVE-2025-66675-Apache Struts has a Denial of Service vulnerability

apache/struts · GHSA-rg58-xhh7-mqjw

low2025-12-10

CVE-2025-14082-Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions

keycloak/keycloak · GHSA-6q37-7866-h27j

medium2025-12-10

CVE-2025-65513-Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability

zcaceres/fetch-mcp · GHSA-8fxj-2g9q-8fjw

high2025-12-10

CVE-2025-67644-LangGraph's SQLite is vulnerable to SQL injection via metadata filter key in SQLite checkpointer list method

langchain-ai/langgraph · GHSA-9rwj-6rc7-p77c

medium2025-12-09

OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs

opentofu/opentofu · GHSA-mjcp-gpgx-ggcg

critical2025-12-09

CVE-2025-67511-Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool

aliasrobotics/cai · GHSA-4c65-9gqf-4w8h

low2025-12-09

CVE-2025-14284-@tiptap/extension-link vulnerable to Cross-site Scripting (XSS)

ueberdosis/tiptap · GHSA-vhrc-hgrq-x75r

critical2025-12-09

CVE-2025-14306-Robocode vulnerable to Directory Traversal in recursivelyDelete Method

robo-code/robocode · GHSA-j8r2-47rx-qhw4

critical2025-12-09

CVE-2025-14307-Robocode has an insecure temporary file creation vulnerability in the AutoExtract component

robo-code/robocode · GHSA-2mxr-rc97-xrj2

medium2025-12-09

CVE-2025-13877-Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments

nocobase/nocobase · GHSA-mv7p-34fv-4874