Security advisories

medium2025-11-06

CVE-2025-64435-KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

kubevirt/kubevirt · GHSA-9m94-w2vq-hcf9

medium2025-11-06

CVE-2025-64434-KubeVirt's Improper TLS Certificate Management Handling Allows API Identity Spoofing

kubevirt/kubevirt · GHSA-ggp9-c99x-54gp

medium2025-11-06

CVE-2025-64433-KubeVirt Arbitrary Container File Read

kubevirt/kubevirt · GHSA-qw6q-3pgr-5cwq

medium2025-11-06

CVE-2025-64432-KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer

kubevirt/kubevirt · GHSA-38jw-g2qx-4286

medium2025-11-06

CVE-2025-64329-containerd CRI server: Host memory exhaustion through Attach goroutine leak

containerd/containerd · GHSA-m6hq-p25p-ffr2

high2025-11-06

CVE-2025-12790-MQTT does not validate hostnames

njh/ruby-mqtt · GHSA-9c5q-w6gr-fxcq

high2025-11-06

CVE-2025-64173-Apollo Router Affected by an Access Control Bypass on Polymorphic Types

apollographql/router · GHSA-x33c-7c2v-mrj9

high2025-11-06

CVE-2025-64347-Apollo Router Improperly Enforces Renamed Access Control Directives

apollographql/router · GHSA-g8jh-vg5j-4h3f

high2025-11-06

CVE-2025-64501-Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values

etaminstudio/prosemirror_to_html · GHSA-52c5-vh7f-26fx

low2025-11-06

OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses

opentofu/opentofu · GHSA-w2jf-268q-mrvh

low2025-11-06

CVE-2025-64481-Open redirect endpoint in Datasette

simonw/datasette · GHSA-w832-gg5g-x44m

high2025-11-06

CVE-2024-25621-containerd affected by a local privilege escalation via wide permissions on CRI directory

containerd/containerd · GHSA-pwhc-rpq9-4c8w

high2025-11-05

CVE-2025-64439-LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer

langchain-ai/langgraph · GHSA-wwqv-p2pp-99h5

high2025-11-05

CVE-2025-64430-Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format

parse-community/parse-server · GHSA-x4qj-2f4q-r4rx

high2025-11-05

CVE-2025-64431-IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering

zitadel/zitadel · GHSA-cpf4-pmr4-w6cx

low2025-11-05

CVE-2025-64326-Weblate leaks the IP of project member inviting user to be reviewer in Audit log

weblateorg/weblate · GHSA-gr35-vpx2-qxhc

high2025-11-05

CVE-2025-62596-youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects

youki-dev/youki · GHSA-vf95-55w6-qmrf

high2025-11-05

CVE-2025-62161-youki container escape via "masked path" abuse due to mount race conditions

youki-dev/youki · GHSA-4g74-7cff-xcv8

high2025-11-05

CVE-2025-52881-runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects

opencontainers/runc · GHSA-cgrx-mc8f-2prm

medium2025-11-05

CVE-2025-10713-WSO2 Carbon Mediation vulnerable to XML External Entity (XXE) attacks

wso2/carbon-mediation · GHSA-fvfq-q238-j7j3