Security advisories

medium2025-12-04

CVE-2025-56427-ComposioHQ has a directory traversal vulnerability

composiohq/composio · GHSA-3mwv-j45g-vp3w

high2025-12-04

libcrux incorrectly calculates on aarch64

cryspen/libcrux · GHSA-2cgv-28vr-rv6j

medium2025-12-04

CVE-2025-11222-Central Dogma's Login Function Has an Open Redirect Vulnerability

line/centraldogma · GHSA-4hr2-xf7w-jf76

low2025-12-04

CVE-2025-66479-Anthropic Sandbox Runtime Incorrectly Implemented Network Sandboxing

anthropic-experimental/sandbox-runtime · GHSA-9gqj-5w7c-vx47

high2025-12-04

CVE-2025-65945-auth0/node-jws Improperly Verifies HMAC Signature

auth0/node-jws · GHSA-869p-cjfg-cm3x

high2025-12-04

CVE-2025-65346-alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality

alexusmai/laravel-file-manager · GHSA-q5hg-wppq-r2cc

medium2025-12-04

CVE-2025-14010-Ansible Community General Collection is vulnerable to exposure of sensitive information

ansible-collections/community.general · GHSA-8ggh-xwr9-3373

low2025-12-03

CVE-2025-65345-alexusmai laravel-file-manager is vulnerable to Directory Traversal

alexusmai/laravel-file-manager · GHSA-rr44-8j7r-jg2q

high2025-12-03

CVE-2024-3884-Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded

undertow-io/undertow · GHSA-6h4f-pj3g-q8fq

medium2025-12-03

CVE-2025-66404-mcp-server-kubernetes has potential security issue in exec_in_pod tool

flux159/mcp-server-kubernetes · GHSA-wvxp-jp4w-w8wg

critical2025-12-03

React Server Components are Vulnerable to RCE

vitejs/vite-plugin-react · GHSA-fmh4-wr37-44fp

critical2025-12-03

CVE-2025-55182-React Server Components are Vulnerable to RCE

facebook/react · GHSA-fv66-9v8q-g76r

critical2025-12-03

Next.js is vulnerable to RCE in React flight protocol

vercel/next.js · GHSA-9qr9-h5gf-34mp

critical2025-12-03

CVE-2025-44005-Step CA Has Authorization Bypass in ACME and SCEP Provisioners

smallstep/certificates · GHSA-h8cp-697h-8c8p

low2025-12-03

CVE-2025-66453-Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function

mozilla/rhino · GHSA-3w8q-xq97-5j7x

high2025-12-03

CVE-2025-66411-Coder logs sensitive objects unsanitized

coder/coder · GHSA-jf75-p25m-pw74

medium2025-12-03

CVE-2025-66406-step-ca Has Improper Authorization Check for SSH Certificate Revocation

smallstep/certificates · GHSA-j7c9-79x7-8hpr

high2025-12-03

CVE-2025-66032-Claude Code Command Validation Bypass Allows Arbitrary Code Execution

anthropics/claude-code · GHSA-xq4m-mc3c-vvg3

high2025-12-03

CVE-2025-64443-Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode

docker/mcp-gateway · GHSA-46gc-mwh4-cc5r

high2025-12-03

CVE-2025-66468-Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors

aimeos/ai-cms-grapesjs · GHSA-424m-fj2q-g7vg