Security advisories

high2025-11-24

CVE-2025-62155-new-api is vulnerable to SSRF Bypass

quantumnous/new-api · GHSA-9f46-w24h-69w4

high2025-11-24

CVE-2025-13609-Keylime allows users to register new agents by recycling existing UUIDs when using different TPM devices

keylime/keylime · GHSA-xh5w-g8gq-r3v9

medium2025-11-24

CVE-2025-60632-Free5GC is vulnerable to DoS through its Npcf_BDTPolicyControl POST API

free5gc/pcf · GHSA-vgq7-9r5r-j9v3

high2025-11-24

CVE-2025-60638-NSSF panic due to nil pointer dereference when expiry field is omitted in NSSAIAvailability POST

free5gc/nssf · GHSA-f2hj-vpp9-6vm2

medium2025-11-24

CVE-2025-60633-Free5GC is vulnerable to DoS via the Nudm_SubscriberDataManagement API

free5gc/pcf · GHSA-3j9f-7w24-pcqg

high2025-11-24

CVE-2025-65998-Apache Syncope's AES encryption stores hard-coded passwords in internal database

apache/syncope · GHSA-jqg8-m35q-jh7j

high2025-11-21

CVE-2025-65947-thread-amount Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS

jzeuzs/thread-amount · GHSA-jf9p-2fv9-2jp2

low2025-11-21

CVE-2025-65111-SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results

authzed/spicedb · GHSA-9m7r-g8hg-x3vr

medium2025-11-21

CVE-2025-62609-MLX has Wild Pointer Dereference in load_gguf()

ml-explore/mlx · GHSA-j842-xgm4-wf88

medium2025-11-21

CVE-2025-62608-MLX has heap-buffer-overflow in load()

ml-explore/mlx · GHSA-w6vg-jg77-2qg6

critical2025-11-21

CVE-2025-41115-Grafana Incorrect Privilege Assignment vulnerability

grafana/grafana · GHSA-w62r-7c53-fmc5

high2025-11-21

CVE-2025-13357-Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default

hashicorp/terraform-provider-vault · GHSA-gmm6-j2g5-r52m

medium2025-11-20

CVE-2025-64751-OpenFGA Improper Policy Enforcement

openfga/openfga · GHSA-2c64-vmv2-hgfc

high2025-11-20

Minder does not sandbox http.send in Rego programs

mindersec/minder · GHSA-6xvf-4vh9-mw47

medium2025-11-20

CVE-2025-63700-Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage

clerk/javascript · GHSA-3mm3-wfpv-q85g

high2025-11-20

CVE-2025-64762-authkit-nextjs may let session cookies be cached in CDNs

workos/authkit-nextjs · GHSA-p8pf-44ff-93gf

high2025-11-20

CVE-2025-64755-@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

anthropics/claude-code · GHSA-7mv8-j34q-vp7q

medium2025-11-20

CVE-2025-62426-vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

vllm-project/vllm · GHSA-69j4-grxj-j64p

high2025-11-20

CVE-2025-62372-vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

vllm-project/vllm · GHSA-pmqf-x6x8-p7qw

high2025-11-20

CVE-2025-62164-vLLM deserialization vulnerability leading to DoS and potential RCE

vllm-project/vllm · GHSA-mrw7-hf4f-83pf