Security advisories

high2025-11-27

CVE-2025-12758-Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements

validatorjs/validator.js · GHSA-vghf-hv5q-vc2g

critical2025-11-27

CVE-2025-34351-Ray's New Token Authentication is Disabled By Default

ray-project/ray · GHSA-gx77-xgc2-4888

high2025-11-26

CVE-2025-66035-Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

angular/angular · GHSA-58c5-g7wp-6w37

low2025-11-26

Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions

better-auth/better-auth · GHSA-wmjr-v86c-m9jj

medium2025-11-26

CVE-2025-66219-willitmerge has a Command Injection vulnerability

shama/willitmerge · GHSA-j9wj-m24m-7jj6

high2025-11-26

CVE-2025-66031-node-forge has ASN.1 Unbounded Recursion

digitalbazaar/forge · GHSA-554w-wpv2-vw27

medium2025-11-26

CVE-2025-66030-node-forge is vulnerable to ASN.1 OID Integer Truncation

digitalbazaar/forge · GHSA-65ch-62r8-g69g

high2025-11-26

CVE-2025-12816-node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization

digitalbazaar/forge · GHSA-5gfm-wpxj-wjgq

low2025-11-26

CVE-2025-65681-Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control

overhangio/tutor · GHSA-gq25-78jf-v78c

critical2025-11-26

CVE-2025-62593-Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack

ray-project/ray · GHSA-q279-jhrf-cc6v

high2025-11-26

CVE-2025-66020-Valibot has a ReDoS vulnerability in `EMOJI_REGEX`

open-circle/valibot · GHSA-vqpr-j7v3-hqw9

high2025-11-26

CVE-2025-65966-OneUptime Unauthorized User Creation via API

oneuptime/oneuptime · GHSA-m449-vh5f-574g

high2025-11-26

CVE-2025-62728-Hive Metastore Server is vulnerable to SQL Injection

apache/hive · GHSA-932v-x9x2-vq29

critical2025-11-26

CVE-2025-59390-Apache Druid’s Kerberos authenticator uses a weak fallback secret

apache/druid · GHSA-w88f-4875-99c8

medium2025-11-25

CVE-2025-66026-REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]

redaxo/redaxo · GHSA-x6vr-q3vf-vqgq

critical2025-11-25

libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)

mullvad/nftnl-rs · GHSA-2fjw-whxm-9v4q

medium2025-11-25

CVE-2025-66028-OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation

oneuptime/oneuptime · GHSA-675q-66gf-gqg8

high2025-11-25

CVE-2025-66021-OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

owasp/java-html-sanitizer · GHSA-g9gq-3pfx-2gw2

high2025-11-25

Better Auth Passkey Plugin allows passkey deletion through IDOR

better-auth/better-auth · GHSA-4vcf-q4xf-f48m

high2025-11-25

CVE-2025-9624-OpenSearch is vulnerable to DoS via complex query_string inputs

opensearch-project/opensearch · GHSA-mw3v-mmfw-3x2g