Security advisories

high2025-12-08

CVE-2025-66507-1Panel – CAPTCHA Bypass via Client-Controlled Flag

1panel-dev/1panel · GHSA-qmg5-v42x-qqhq

medium2025-12-08

CVE-2025-66491-Traefik Inverted TLS Verification Logic in ingress-nginx Provider

traefik/traefik · GHSA-7vww-mvcr-x6vj

medium2025-12-08

CVE-2025-66490-Path Normalization Bypass in Traefik Router + Middleware Rules

traefik/traefik · GHSA-gm3x-23wp-hc2c

medium2025-12-08

CVE-2025-66202-Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

withastro/astro · GHSA-whqg-ppgf-wp8c

critical2025-12-06

CVE-2025-34291-Langflow CORS misconfiguration enables Account Takeover and RCE

langflow-ai/langflow · GHSA-577h-p2hh-v4mv

high2025-12-05

CVE-2025-66623-Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands

strimzi/strimzi-kafka-operator · GHSA-xrhh-hx36-485q

medium2025-12-05

nitro-tpm-pcr-compute may allow kernel command line modification by an account operator

aws/nitrotpm-attestation-samples · GHSA-xrv8-2pf5-f3q7

high2025-12-05

CVE-2025-66566-yawkat LZ4 Java has a possible information leak in Java safe decompressor

yawkat/lz4-java · GHSA-cmp6-m4wj-q63q

high2025-12-05

CVE-2025-66564-Sigstore Timestamp Authority allocates excessive memory during request parsing

sigstore/timestamp-authority · GHSA-4qg8-fj49-pxjh

high2025-12-05

CVE-2025-66506-Fulcio allocates excessive memory during token parsing

sigstore/fulcio · GHSA-f83f-xpx7-ffpw

high2025-12-05

CVE-2025-66471-urllib3 streaming API improperly handles highly compressed data

urllib3/urllib3 · GHSA-2xpw-w6gg-jr37

high2025-12-05

CVE-2025-66418-urllib3 allows an unbounded number of links in the decompression chain

urllib3/urllib3 · GHSA-gm62-xv2j-4w53

medium2025-12-05

CVE-2025-66220-Envoy's TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte

envoyproxy/envoy · GHSA-rwjg-c3h2-f57p

low2025-12-05

CVE-2025-64763-Envoy forwards early CONNECT data in TCP proxy mode

envoyproxy/envoy · GHSA-rj35-4m94-77jh

medium2025-12-05

CVE-2025-64527-Envoy crashes when JWT authentication is configured with the remote JWKS fetching

envoyproxy/envoy · GHSA-mp85-7mrq-r866

high2025-12-04

CVE-2025-65959-Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'

open-webui/open-webui · GHSA-8wvc-869r-xfqf

high2025-12-04

CVE-2025-65958-Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web

open-webui/open-webui · GHSA-c6xv-rcvw-v685

high2025-12-04

CVE-2025-65637-Logrus is vulnerable to DoS when using Entry.Writer()

sirupsen/logrus · GHSA-4f99-4q7p-p3gh

critical2025-12-04

CVE-2025-66516-Apache Tika has XXE vulnerability

apache/tika · GHSA-f58c-gq56-vjjf

low2025-12-04

CVE-2025-63681-open-webui is Vulnerable to Incorrect Access Control

open-webui/open-webui · GHSA-frv8-gffc-37px