Security advisories

high2025-12-09

CVE-2025-67648-Shopware Storefront Reflected XSS in Storefront Login Page

shopware/shopware · GHSA-6w82-v552-wjw2

critical2025-12-09

SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475

saml-toolkits/php-saml · GHSA-5j8p-438x-rgg5

medium2025-12-09

JDA (Java Discord API) downloads external URLs when updating message components

discord-jda/jda · GHSA-93fv-4pm9-xp28

critical2025-12-09

CVE-2025-67510-Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)

neuron-core/neuron-ai · GHSA-898v-775g-777c

high2025-12-09

CVE-2025-67509-Neuron MySQLSelectTool “read-only” bypass via `SELECT ... INTO OUTFILE` (file write → potential RCE)

neuron-core/neuron-ai · GHSA-j8g6-5gqc-mq36

high2025-12-09

CVE-2025-67507-Filament multi-factor authentication (app) recovery codes can be used multiple times

filamentphp/filament · GHSA-pvcv-q3q7-266g

medium2025-12-09

CVE-2025-67499-CNA Plugins Portmap nftables backend can intercept non-local traffic

containernetworking/plugins · GHSA-jv3w-x3r3-g6rm

high2025-12-09

SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin

siyuan-note/siyuan · GHSA-4r66-7rcv-x46x

high2025-12-09

CVE-2025-67488-SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE

siyuan-note/siyuan · GHSA-gqfv-g4v7-m366

medium2025-12-09

CVE-2025-67485-HTTP/HTTPS Traffic Interception Bypass in mad-proxy

machphy/mad-proxy · GHSA-wx63-35hw-2482

high2025-12-09

CVE-2025-66626- RCE via ZipSlip and symbolic links in argoproj/argo-workflows

argoproj/argo-workflows · GHSA-xrqc-7xgx-c9vh

medium2025-12-09

CVE-2025-66625-Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality

umbraco/umbraco-cms · GHSA-hfv2-pf68-m33x

high2025-12-09

CVE-2025-66457-Elysia affected by arbitrary code injection through cookie config

elysiajs/elysia · GHSA-8vch-m3f4-q8jf

critical2025-12-09

CVE-2025-66456-Elysia vulnerable to prototype pollution with multiple standalone schema validation

elysiajs/elysia · GHSA-hxj9-33pp-j2cc

medium2025-12-09

CVE-2025-67502-Open Redirect Vulnerability in Taguette

remram44/taguette · GHSA-5923-r76v-mprm

high2025-12-09

CVE-2025-66645-NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read

zauberzeug/nicegui · GHSA-hxp3-63hc-5366

medium2025-12-09

Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond

babylonlabs-io/babylon · GHSA-4rmq-mc2c-r495

high2025-12-08

Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers

babylonlabs-io/babylon · GHSA-m6wq-66p2-c8pc

high2025-12-08

CVE-2025-67495-ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login

zitadel/zitadel · GHSA-v959-qxv6-6f8p

high2025-12-08

CVE-2026-29067-ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login

zitadel/zitadel · GHSA-pfrf-9r5f-73f5