Security advisories

critical2025-10-07

CVE-2025-61778-Akka.Remote TLS did not properly implement certificate-based authentication

akkadotnet/akka.net · GHSA-jhpv-4q4f-43g5

high2025-10-07

CVE-2025-61772-Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

rack/rack · GHSA-wpv5-97wm-hp9c

high2025-10-07

CVE-2025-61771-Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

rack/rack · GHSA-w9pc-fmgc-vxvw

high2025-10-07

CVE-2025-61770-Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

rack/rack · GHSA-p543-xpfm-54cp

high2025-10-07

CVE-2025-59425-vLLM is vulnerable to timing attack at bearer auth

vllm-project/vllm · GHSA-wr9h-g72x-mwhm

medium2025-10-07

CVE-2025-13033-Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

nodemailer/nodemailer · GHSA-mm7p-fcc7-pg87

medium2025-10-07

CVE-2025-61765-python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments

miguelgrinberg/python-socketio · GHSA-g8c6-8fjj-2r4m

high2025-10-07

CVE-2025-11362-pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding

bpampuch/pdfmake · GHSA-rj3r-r7hh-jxfq

medium2025-10-07

CVE-2025-43824-Liferay Profile Widget does not prevent vCard extension spoofing

liferay/liferay-portal · GHSA-pfxj-gvqg-mj44

critical2025-10-06

CVE-2025-59159-SillyTavern Web Interface Vulnerable DNS Rebinding

sillytavern/sillytavern · GHSA-7cxj-w27x-x78q

high2025-10-06

CVE-2025-59152-Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion

litestar-org/litestar · GHSA-hm36-ffrh-c77c

critical2025-10-06

CVE-2025-52472-XWiki Platform is vulnerable to HQL injection via wiki and space search REST API

xwiki/xwiki-platform · GHSA-gprp-h92g-gc2h

high2025-10-06

CVE-2025-6985-LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing

langchain-ai/langchain · GHSA-m42m-m8cr-8m58

critical2025-10-06

CVE-2025-49594-XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view

xwiki-contrib/oidc · GHSA-f2hf-pfrj-vrm7

critical2025-10-06

CVE-2025-55346-Flowise vulnerable to RCE via Dynamic function constructor injection

flowiseai/flowise · GHSA-hmgh-466j-fx4c

low2025-10-06

CVE-2025-11322-NovoSGA: Manipulation of User Creation Page can lead to weak password requirements

novosga/novosga · GHSA-xgr2-5837-hf48

medium2025-10-05

CVE-2025-8917-clearml is vulnerable to Path Traversal through its `safe_extract` function

clearml/clearml · GHSA-579p-qf78-fqm2

medium2025-10-05

CVE-2025-11287-MCPHub has an Improper Authorization vulnerability via its handleSseConnection function

samanhappy/mcphub · GHSA-v7c4-33vf-cqqq

medium2025-10-05

CVE-2025-8406-ZenML is vulnerable to Path Traversal through its `PathMaterializer` class

zenml-io/zenml · GHSA-q92x-2x5g-h365

low2025-10-05

CVE-2025-11285-MCPHub's ServerController is vulnerable to Command Injection

samanhappy/mcphub · GHSA-5q2p-3jg8-2m98