Security advisories

high2025-09-29

CVE-2025-59952-MinIO Java Client XML Tag Value Substitution Vulnerability

minio/minio-java · GHSA-h7rh-xfpj-hpcm

critical2025-09-29

j178/prek-action vulnerable to arbitrary code injection in composite action

j178/prek-action · GHSA-pwf7-47c3-mfhx

medium2025-09-29

CVE-2025-59940-mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders

mondeja/mkdocs-include-markdown-plugin · GHSA-v39m-5m9j-m9w9

high2025-09-29

CVE-2025-59937-go-mail has insufficient address encoding when passing mail addresses to the SMTP client

wneessen/go-mail · GHSA-wpwj-69cm-q9c5

low2025-09-29

CVE-2025-59163-vet MCP Server SSE Transport DNS Rebinding Vulnerability

safedep/vet · GHSA-6q9c-m9fr-865m

high2025-09-27

CVE-2025-7647-llama-index-core insecurely handles temporary files

run-llama/llama_index · GHSA-cr7q-2w66-hjcm

medium2025-09-27

CVE-2025-10954-github.com/nyaruka/phonenumbers Vulnerable to Improper Validation of Syntactic Correctness of Input

nyaruka/phonenumbers · GHSA-fmjh-f678-cv3x

medium2025-09-27

CVE-2025-3193-algoliasearch-helper is vulnerable to Prototype Pollution in _merge()

algolia/algoliasearch-helper-js · GHSA-529q-4j3p-7c5r

medium2025-09-26

CVE-2025-57692-PiranhaCMS stored XSS

piranhacms/piranha.core · GHSA-456v-f425-8mcv

medium2025-09-26

OpenMLS improper persistence of the secret tree during message processing

openmls/openmls · GHSA-qr9h-x63w-vqfm

low2025-09-26

kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace

kcp-dev/kcp · GHSA-q6hv-wcjr-wp8h

high2025-09-26

CVE-2025-59845-Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass

apollographql/embeddable-explorer · GHSA-w87v-7w53-wwxv

medium2025-09-26

CVE-2025-59364-express-xss-sanitizer has an unbounded recursion depth

ahmedadelfahim/express-xss-sanitizer · GHSA-hvq2-wf92-j4f3

critical2025-09-26

CVE-2025-59936-get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass

nearform/get-jwks · GHSA-qc2q-qhf3-235m

low2025-09-26

CVE-2025-59842-JupyterLab LaTeX typesetter links did not enforce `noopener` attribute

jupyterlab/jupyterlab · GHSA-vvfj-2jqx-52jm

high2025-09-26

CVE-2024-58260-Rancher update on users can deny the service to the admin

rancher/rancher · GHSA-q82v-h4rq-5c86

high2025-09-26

CVE-2024-58267-Rancher CLI SAML authentication is vulnerable to phishing attacks

rancher/rancher · GHSA-v3vj-5868-2ch2

medium2025-09-26

CVE-2025-54468-Rancher sends sensitive information to external services through the `/meta/proxy` endpoint

rancher/rancher · GHSA-mjcp-rj3c-36fr

high2025-09-26

CVE-2025-59844-Argument injection vulnerability in SonarQube Scan Action

sonarsource/sonarqube-scan-action · GHSA-5xq9-5g24-4g6f

low2025-09-26

CVE-2025-1396-WSO2's Input Validation Management Service contains Observable Discrepancy when Multi-Attribute Login is enabled

wso2/carbon-identity-framework · GHSA-w82p-r9vw-4rg5