Security advisories

low2025-11-25

CVE-2025-65961-Contao is vulnerable to cross-site scripting in templates

contao/contao · GHSA-68q5-78xp-cwwc

medium2025-11-25

CVE-2025-65960-Contao is vulnerable to remote code execution in template closures

contao/contao · GHSA-98vj-mm79-v77r

high2025-11-25

CVE-2025-66017-cggmp24 and cggmp21 are vulnerable to signature forgery through altered presignatures

lfdt-lockness/cggmp21 · GHSA-8frv-q972-9rq5

critical2025-11-25

CVE-2025-66016-cggmp21 has a missing check in the ZK proof used in CGGMP21

lfdt-lockness/cggmp21 · GHSA-m95p-425x-x889

low2025-11-25

CVE-2025-65942-VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM

victoriametrics/victoriametrics · GHSA-66jq-2c23-2xh5

high2025-11-25

CVE-2025-62703-Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer

fugue-project/fugue · GHSA-xv5p-fjw5-vrj6

high2025-11-25

CVE-2025-58360-GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

geoserver/geoserver · GHSA-fjf5-xgmq-5525

medium2025-11-25

CVE-2025-21621-GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format

geoserver/geoserver · GHSA-w66h-j855-qr72

high2025-11-25

CVE-2025-64050-REDAXO CMS is vulnerable to RCE attack through its template management component

redaxo/redaxo · GHSA-xj9j-gjxg-7jvq

medium2025-11-25

CVE-2025-64049-REDAXO CMS is vulnerable to XSS through its module management component

redaxo/redaxo · GHSA-vqc7-7fj4-3fm3

medium2025-11-25

CVE-2025-13466-body-parser is vulnerable to denial of service when url encoding is used

expressjs/body-parser · GHSA-wqch-xfxh-vrr4

high2025-11-25

CVE-2025-65965-Grype has a credential disclosure vulnerability in its JSON output

anchore/grype · GHSA-6gxw-85q2-q646

low2025-11-24

OMERO.web uses jquery-form library, which may be vulnerable to XSS attack

ome/omero-web · GHSA-j4gv-6x9v-v23g

medium2025-11-24

Babylon's BIP322 signature implementation is not fully compliant to the spec

babylonlabs-io/babylon · GHSA-xq4h-wqm2-668w

high2025-11-24

Babylon's malformed vote extensions are not rejected

babylonlabs-io/babylon · GHSA-2fcv-qww3-9v6h

critical2025-11-24

LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction

lf-edge/ekuiper · GHSA-rj4j-2jph-gg43

medium2025-11-24

CVE-2025-66019-pypdf's LZWDecode streams be manipulated to exhaust RAM

py-pdf/pypdf · GHSA-m449-cwjh-6pw7

medium2025-11-24

CVE-2025-65956-Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags

getformwork/formwork · GHSA-7j46-f57w-76pj

medium2025-11-24

CVE-2025-65944-Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`

getsentry/sentry-javascript · GHSA-6465-jgvq-jhgp

high2025-11-24

CVE-2025-64761-OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation

openbao/openbao · GHSA-7ff4-jw48-3436