Security advisories

medium2025-11-20

CVE-2025-13437-zx Uses Incorrectly-Resolved Name or Reference

google/zx · GHSA-w87r-vg9q-crqm

medium2025-11-20

CVE-2025-64027-Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow

grokability/snipe-it · GHSA-8x9v-8qgj-945x

low2025-11-20

CVE-2025-13425-OSV-SCALIBR has NULL Pointer Dereference

google/osv-scalibr · GHSA-f786-75f3-74xj

critical2025-11-20

CVE-2025-65108-md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter

simonhaenisch/md-to-pdf · GHSA-547r-qmjm-8hvw

high2025-11-20

CVE-2025-65106-LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates

langchain-ai/langchain · GHSA-6qv9-48xg-fc7f

critical2025-11-20

CVE-2025-64767-@hpke/core reuses AEAD nonces

dajiaji/hpke-js · GHSA-73g8-5h73-26h4

medium2025-11-20

CVE-2025-60799-phppgadmin contains an incorrect access control vulnerability

phppgadmin/phppgadmin · GHSA-r63p-v37q-g74c

medium2025-11-20

CVE-2025-60798-phppgadmin contains a SQL injection vulnerability

phppgadmin/phppgadmin · GHSA-g6xh-wrpf-v6j6

medium2025-11-20

CVE-2025-60794-@perfood/couch-auth may expose session tokens, passwords

perfood/couch-auth · GHSA-62vx-hpcr-m9ch

low2025-11-20

CVE-2025-60796-phppgadmin vulnerable to Cross-site Scripting

phppgadmin/phppgadmin · GHSA-h369-cpjj-qfff

low2025-11-20

CVE-2025-13435-Resty has a Path Traversal vulnerability

dreampie/resty · GHSA-cv3m-hxpc-4hvm

medium2025-11-20

CVE-2025-60797-phppgadmin contains a SQL injection vulnerability

phppgadmin/phppgadmin · GHSA-927w-vq5c-8gc3

high2025-11-19

CVE-2025-65103-OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter

devcode-it/openstamanager · GHSA-2jm2-2p35-rp3j

high2025-11-19

CVE-2025-65099-Claude Code vulnerable to command execution prior to startup trust dialog

anthropics/claude-code · GHSA-5hhx-v7f6-x7gv

medium2025-11-19

CVE-2025-65026-esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript

esm-dev/esm.sh · GHSA-hcpf-qv9m-vfgp

high2025-11-19

CVE-2025-65025-esm.sh CDN service has arbitrary file write via tarslip

esm-dev/esm.sh · GHSA-h3mw-4f23-gwpw

medium2025-11-19

CVE-2025-65019-Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint

withastro/astro · GHSA-fvmw-cj7j-j39q

medium2025-11-19

CVE-2025-64765-Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values

withastro/astro · GHSA-ggxq-hp9w-j794

high2025-11-19

CVE-2025-64764-Astro vulnerable to reflected XSS via the server islands feature

withastro/astro · GHSA-wrwg-2hg8-v723

low2025-11-19

CVE-2025-64757-Astro Development Server has Arbitrary Local File Read

withastro/astro · GHSA-x3h8-62x9-952g