Security advisories

high2025-11-12

CVE-2025-2843-Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack

rhobs/observability-operator · GHSA-mj6p-p843-x5wc

high2025-11-12

CVE-2025-63811-jose2go is vulnerable to a JWT bomb attack through its decode function

dvsekhvalnov/jose2go · GHSA-9mj6-hxhv-w67j

critical2025-11-10

CVE-2025-64522-Soft Serve is vulnerable to SSRF through its Webhooks

charmbracelet/soft-serve · GHSA-vwq2-jx9q-9h9f

high2025-11-10

CVE-2025-64519-TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter

torrentpier/torrentpier · GHSA-4rwr-8c3m-55f6

high2025-11-10

CVE-2025-64518-CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

cyclonedx/cyclonedx-core-java · GHSA-6fhj-vr9j-g45r

high2025-11-10

CVE-2025-12613-Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand

cloudinary/cloudinary_npm · GHSA-g4mf-96x5-5m2c

low2025-11-09

CVE-2025-12919-EverShop is vulnerable to Unauthorized Order Information Access (IDOR)

evershopcommerce/evershop · GHSA-c73g-mx2w-cc93

low2025-11-09

CVE-2025-12918-Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice

yungifez/skuul · GHSA-fqq7-h225-8w6h

high2025-11-07

CVE-2025-70559-Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

pdfminer/pdfminer.six · GHSA-f83h-ghpp-7wcc

high2025-11-07

CVE-2025-64512-Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

pdfminer/pdfminer.six · GHSA-wf5f-4jwr-ppcp

high2025-11-07

CVE-2025-64324-KubeVirt Vulnerable to Arbitrary Host File Read and Write

kubevirt/kubevirt · GHSA-46xp-26xh-hpqh

medium2025-11-07

CVE-2025-57697-AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64

astrbotdevs/astrbot · GHSA-vm2f-46xc-5jc3

high2025-11-07

CVE-2025-57698-AstrBot contains a directory traversal vulnerability

astrbotdevs/astrbot · GHSA-xrj9-mw57-j34v

high2025-11-07

CVE-2025-64496-Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

open-webui/open-webui · GHSA-cm35-v4vp-5xvx

high2025-11-07

CVE-2025-64495-Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

open-webui/open-webui · GHSA-w7xj-8fx7-wfch

medium2025-11-07

CVE-2025-52662-Nuxt DevTools vulnerable to cross-site scripting (XSS)

nuxt/devtools · GHSA-xmq3-q5pm-rp26

low2025-11-07

CVE-2025-48985-Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

vercel/ai · GHSA-rwvc-j5jr-mgvh

medium2025-11-06

CVE-2025-64494-Soft Serve does not sanitize ANSI escape sequences in user input

charmbracelet/soft-serve · GHSA-fv2r-r8mp-pg48

medium2025-11-06

CVE-2025-64437-KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes

kubevirt/kubevirt · GHSA-2r4r-5x78-mvqf

medium2025-11-06

CVE-2025-64436-KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes

kubevirt/kubevirt · GHSA-7xgm-5prm-v5gc