Security advisories

medium2025-10-22

CVE-2025-62707-pypdf possibly loops infinitely when reading DCT inline images without EOF marker

py-pdf/pypdf · GHSA-vr63-x8vc-m265

low2025-10-22

CVE-2025-11966-Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names

vert-x3/vertx-web · GHSA-45p5-v273-3qqr

medium2025-10-22

CVE-2025-11965-Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories

vert-x3/vertx-web · GHSA-h5fg-jpgr-rv9c

medium2025-10-22

CVE-2025-62513-OpenBao leaks HTTPRawBody in Audit Logs

openbao/openbao · GHSA-ghfh-fmx4-26h8

medium2025-10-22

ncurses exposes uninitialized memory in string reading functions

jeaye/ncurses-rs · GHSA-x77x-7mmh-cxv3

high2025-10-22

CVE-2025-62611-aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server

aio-libs/aiomysql · GHSA-r397-ff8c-wv2g

high2025-10-22

CVE-2025-62617-Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality

admidio/admidio · GHSA-2v5m-cq9w-fc33

medium2025-10-22

Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization

secdev/scapy · GHSA-cq46-m9x9-j8w2

low2025-10-22

Borrowck Scarifices exposes uninitialized memory in any_as_u8_slice

alexpyattaev/borrowck_sacrifices · GHSA-xcpm-76hf-c9cc

medium2025-10-22

CVE-2025-11844-Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function

huggingface/smolagents · GHSA-8mf9-rmgw-33qc

high2025-10-22

CVE-2025-62610-Hono Improper Authorization vulnerability

honojs/hono · GHSA-m732-5p4w-x69g

low2025-10-21

Direct Ring Buffer has uninitialized memory exposure in create_ring_buffer

ain1084/direct_ring_buffer · GHSA-fp5x-7m4q-449f

low2025-10-21

orx-pinned-vec has undefined behavior in index_of_ptr with empty slices

orxfun/orx-pinned-vec · GHSA-h5j3-crg5-8jqm

medium2025-10-21

CVE-2025-62607-Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL

nautobot/nautobot-app-ssot · GHSA-535g-62r7-cx6v

medium2025-10-21

CVE-2025-62249-Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget

liferay/liferay-portal · GHSA-rx48-gqc2-4w47

medium2025-10-21

CVE-2025-61457-code16 Sharp vulnerable to Cross Site Scripting (XSS)

code16/sharp · GHSA-9778-v769-qvjf

medium2025-10-21

CVE-2025-54471-NeuVector is shipping cryptographic material into its binary

neuvector/neuvector · GHSA-h773-7gf7-9m2x

high2025-10-21

CVE-2025-54470-NeuVector telemetry sender is vulnerable to MITM and DoS

neuvector/neuvector · GHSA-qqj3-g7mx-5p4w

critical2025-10-21

CVE-2025-54469-NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow

neuvector/neuvector · GHSA-c8g6-qrwh-m3vp

low2025-10-21

uv has differential in tar extraction with PAX headers

astral-sh/uv · GHSA-w476-p2h3-79g9