Security advisories

medium2025-12-03

CVE-2025-13472-BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources

jenkinsci/blazemeter-plugin · GHSA-fxp5-37mh-vff5

medium2025-12-02

CVE-2025-65657-FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management

liufee/cms · GHSA-mcxq-54f4-mmx5

critical2025-12-02

CVE-2025-65896-asyncmy is vulnerable to SQL injection via crafted dict keys

long2ice/asyncmy · GHSA-qhqw-rrw9-25rm

high2025-12-02

CVE-2025-13827-GrapesJsBuilder File Upload allows all file uploads

mautic/mautic · GHSA-5xw2-57jx-pgjp

critical2025-12-02

CVE-2025-13828-Mautic user without privileged access to the Marketplace can install and uninstall composer packages

mautic/mautic · GHSA-3fq7-c5m8-g86x

medium2025-12-02

CVE-2025-65105-Apptainer ineffectively applies selinux and apparmor --security options

apptainer/apptainer · GHSA-j3rw-fx6g-q46j

medium2025-12-02

CVE-2025-64750-Singluarity ineffectively applies selinux / apparmor LSM process labels

sylabs/singularity · GHSA-wwrx-w7c9-rf87

medium2025-12-02

CVE-2025-65186-Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor

getgrav/grav · GHSA-cchq-397m-q2qm

medium2025-12-02

CVE-2025-64460-Django is vulnerable to DoS via XML serializer text extraction

django/django · GHSA-vrcr-9hj9-jcg6

medium2025-12-02

CVE-2025-13372-Django is vulnerable to SQL injection in column aliases

django/django · GHSA-rqw2-ghq9-44m7

high2025-12-02

CVE-2025-13353-gokey allows secret recovery from a seed file without the master password

cloudflare/gokey · GHSA-69jw-4jj8-fcxm

medium2025-12-02

CVE-2025-66454-arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints

arcadeai/arcade-mcp · GHSA-g2jx-37x6-6438

high2025-12-02

CVE-2025-66448-vLLM vulnerable to remote code execution via transformers_utils/get_config

vllm-project/vllm · GHSA-8fr4-5q9j-m8gm

high2025-12-02

CVE-2025-66416-Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

modelcontextprotocol/python-sdk · GHSA-9h52-p55h-vw2f

high2025-12-02

CVE-2025-66414-Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

modelcontextprotocol/typescript-sdk · GHSA-w48q-cv73-mx4w

low2025-12-02

CVE-2025-65858-Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

janeczku/calibre-web · GHSA-pc5g-j9j7-p4q3

low2025-12-02

CVE-2025-13870-Mattermost fails to validate user permissions in Boards

mattermost/mattermost · GHSA-58w6-w55x-6wq8

medium2025-12-02

CVE-2025-10543-Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes

eclipse-paho/paho.mqtt.golang · GHSA-32fw-gq77-f2f2

medium2025-12-02

CVE-2025-66400-mdast-util-to-hast has unsanitized class attribute

syntax-tree/mdast-util-to-hast · GHSA-4fh9-h7wg-q85m

high2025-12-02

CVE-2025-66298-Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms

getgrav/grav · GHSA-8535-hvm8-2hmv