Security advisories

critical2025-12-08

CVE-2025-67494-ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login

zitadel/zitadel · GHSA-7wfc-4796-gmg5

medium2025-12-08

CVE-2025-67487-Static Web Server vulnerable to a symbolic link path traversal

static-web-server/static-web-server · GHSA-459f-x8vq-xjjm

critical2025-12-08

CVE-2025-67489-@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server

vitejs/vite-plugin-react · GHSA-j76j-5p5g-9wfr

high2025-12-08

CVE-2025-66631-Csla affected by Remote Code Execution via WcfProxy (NetDataContractSerializer)

marimerllc/csla · GHSA-wq34-7f4g-953v

high2025-12-08

CVE-2025-66627-Critical Use-After-Free in Wasmi's Linear Memory

wasmi-labs/wasmi · GHSA-g4v2-cjqp-rfmq

low2025-12-08

CVE-2025-66622- matrix-sdk-base denial of service via custom m.room.join_rules event values

matrix-org/matrix-rust-sdk · GHSA-jj6p-3m75-g2p3

critical2025-12-08

CVE-2025-66568-Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation

saml-toolkits/ruby-saml · GHSA-x4h9-gwv3-r4m4

critical2025-12-08

CVE-2025-66567-Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)

saml-toolkits/ruby-saml · GHSA-9v8j-x534-2fx3

medium2025-12-08

CVE-2025-66470-NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

zauberzeug/nicegui · GHSA-2m4f-cg75-76w2

medium2025-12-08

CVE-2025-65849-Altcha Proof-of-Work obfuscation mode cryptanalytic break

altcha-org/altcha · GHSA-mpmc-qchh-r9q8

medium2025-12-08

CVE-2025-66469-NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

zauberzeug/nicegui · GHSA-72qc-wxch-74mg

critical2025-12-08

CVE-2025-65964-n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook

n8n-io/n8n · GHSA-wpqc-h9wp-chmq

medium2025-12-08

CVE-2025-65799-memos lacks file name validation or verification

usememos/memos · GHSA-qgjp-5g5x-vhq2

high2025-12-08

CVE-2025-65795-memos vulnerability allows the creation of arbitrary accounts

usememos/memos · GHSA-mg56-wc4q-rw4w

medium2025-12-08

CVE-2025-65797-memos vulnerability allows arbitrarily modification or deletion registered identity providers

usememos/memos · GHSA-99m2-qwx6-2w6f

medium2025-12-08

CVE-2025-65798-memos vulnerability allows arbitrarily modification or deletion of attachments

usememos/memos · GHSA-8p44-g572-557h

medium2025-12-08

CVE-2025-65796-memos vulnerability allows arbitrarily reactions deletion

usememos/memos · GHSA-8jcj-g9f4-qx42

medium2025-12-08

CVE-2025-66578-robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation

robrichards/xmlseclibs · GHSA-c4cc-x928-vjw9

critical2025-12-08

CVE-2025-66565-Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values

gofiber/utils · GHSA-m98w-cqp3-qcqr

medium2025-12-08

CVE-2025-66508-1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers

1panel-dev/1panel · GHSA-7cqv-qcq2-r765