Security advisories

high2025-11-05

CVE-2025-52565-runc container escape with malicious config due to /dev/console mount and related races

opencontainers/runc · GHSA-qw9x-cqr3-wc7r

high2025-11-05

CVE-2025-31133-runc container escape via "masked path" abuse due to mount race conditions

opencontainers/runc · GHSA-9493-h29p-rfm2

high2025-11-05

CVE-2025-64458-Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

django/django · GHSA-qw25-v68c-qjf3

critical2025-11-05

CVE-2025-64459-Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

django/django · GHSA-frmv-pr5f-9mcr

medium2025-11-05

CVE-2025-58337-Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode

apache/doris-mcp-server · GHSA-m35w-xx8c-6xc7

medium2025-11-04

Kgateway transformation policy template can emit files from the container

kgateway-dev/kgateway · GHSA-5pmx-7r6r-wfqq

medium2025-11-04

CVE-2025-64323-kgateway is missing xDS authorization

kgateway-dev/kgateway · GHSA-4766-x535-jw3r

low2025-11-04

Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH

ascopes/protobuf-maven-plugin · GHSA-j2pc-v64r-mv4f

high2025-11-04

CVE-2025-64171-MARIN3R: Cross-Namespace Vulnerability in the Operator

3scale-sre/marin3r · GHSA-gf93-xccm-5g6j

medium2025-11-04

CVE-2025-64187-OctoPrint vulnerable to XSS in Action Commands Notification and Prompt

octoprint/octoprint · GHSA-crvm-xjhm-9h29

high2025-11-04

CVE-2025-64184-Dosage vulnerable to a Directory Traversal through crafted HTTP responses

webcomics/dosage · GHSA-4vcx-3pj3-44m7

medium2025-11-04

CVE-2025-12695-DSPy does not properly restrict file reads

stanfordnlp/dspy · GHSA-vvw2-h478-xwr3

high2025-11-04

CVE-2025-64178-Jellysweep uses uncontrolled data in image cache API endpoint

jon4hz/jellysweep · GHSA-xc93-q32j-cpcg

medium2025-11-03

CVE-2025-64179-lakeFS affected by unauthenticated access to API usage metrics

treeverse/lakefs · GHSA-h238-5mwf-8xw8

high2025-11-03

CVE-2025-60787-motionEye vulnerable to RCE via unsanitized motion config parameter

motioneye-project/motioneye · GHSA-j945-qm58-4gjx

medium2025-11-03

CVE-2025-64174-OpenMage vulnerable to XSS in Admin Notifications

openmage/magento-lts · GHSA-qv78-c8hc-438r

medium2025-11-03

CVE-2025-62520-MantisBT unauthorized disclosure of private project column configuration

mantisbt/mantisbt · GHSA-g582-8vwr-68h2

medium2025-11-03

CVE-2025-55155-MantisBT lacks verification when changing a user's email address

mantisbt/mantisbt · GHSA-q747-c74m-69pr

critical2025-11-03

CVE-2025-11953-@react-native-community/cli has arbitrary OS command injection

react-native-community/cli · GHSA-399j-vxmf-hjvr

medium2025-11-03

CVE-2025-46556-MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length

mantisbt/mantisbt · GHSA-r3jf-hm7q-qfw5