Security advisories

medium2025-11-14

CVE-2025-64714-PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal

privatebin/privatebin · GHSA-g2j9-g8r5-rg82

high2025-11-14

CVE-2025-13204-expr-eval vulnerable to Prototype Pollution

silentmatt/expr-eval · GHSA-8gw3-rxh4-v6jx

high2025-11-14

CVE-2025-64530-@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

apollographql/federation · GHSA-mx7m-j9xf-62hw

medium2025-11-14

CVE-2025-64718-js-yaml has prototype pollution in merge (<<)

nodeca/js-yaml · GHSA-mh29-5h37-fv8m

medium2025-11-14

CVE-2025-11794-Mattermost allows system administrators to access password hashes and MFA secrets

mattermost/mattermost · GHSA-mqp8-pgg5-7x7m

medium2025-11-14

CVE-2025-55070-Mattermost does not enforce MFA on WebSocket connections

mattermost/mattermost · GHSA-xpg8-8xpv-948p

low2025-11-14

CVE-2025-41436-Mattermost allows regular users to access archived channel content and files

mattermost/mattermost · GHSA-x3hx-ch7p-8xgg

medium2025-11-14

CVE-2025-55073-Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL

mattermost/mattermost · GHSA-ff85-qw3h-g9vp

high2025-11-14

CVE-2025-47913-golang.org/x/crypto/ssh/agent has a potential denial of service

golang/crypto · GHSA-56w8-48fp-6mgv

medium2025-11-13

CVE-2025-64749-Directus Vulnerable to Information Leakage in Existing Collections

directus/directus · GHSA-cph6-524f-3hgr

medium2025-11-13

CVE-2025-64748-Directus's conceal fields are searchable if read permissions enabled

directus/directus · GHSA-8jpw-gpr4-8cmh

high2025-11-13

LXD vulnerable to a local privilege escalation through custom storage volumes

canonical/lxd · GHSA-3g2j-vm47-x4mj

low2025-11-13

CVE-2025-64529-SpiceDB WriteRelationships fails silently if payload is too big

authzed/spicedb · GHSA-pm3x-jrhh-qcr7

medium2025-11-13

CVE-2025-64525-Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass

withastro/astro · GHSA-hr2q-hp5q-x767

low2025-11-13

CVE-2025-64745-Astro development server error page is vulnerable to reflected Cross-site Scripting

withastro/astro · GHSA-w2vj-39qv-7vh7

critical2025-11-13

File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency

filebrowser/filebrowser · GHSA-6jqf-mv7m-3q7p

high2025-11-13

CVE-2025-64523-File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function

filebrowser/filebrowser · GHSA-6cqf-cfhv-659g

high2025-11-13

CVE-2025-59840-Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable

vega/vega · GHSA-7f2v-3qq3-vvjf

high2025-11-13

AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance

aws/aws-advanced-nodejs-wrapper · GHSA-8wj8-cfxr-9374

high2025-11-13

AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance

aws/aws-advanced-go-wrapper · GHSA-7wq2-32h4-9hc9