Security advisories

medium2025-09-26

CVE-2025-54831-Apache Airflow: Connection sensitive details exposed to users with READ permissions

apache/airflow · GHSA-q475-2pgm-7hvp

high2025-09-26

CVE-2025-56769-Hutool allows remote code execution (RCE) via the QLExpressEngine class

chinabugotech/hutool · GHSA-gcfh-36x4-mgj6

medium2025-09-25

CVE-2025-43816-Liferay Portal and DXP vulnerable to a memory leak

liferay/liferay-portal · GHSA-hrqm-qpw9-w8rv

medium2025-09-25

CVE-2025-10952-ml-logger file handler allows reading arbitrary files

geyang/ml-logger · GHSA-9x36-c74v-fgr6

high2025-09-25

CVE-2025-59830-Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters

rack/rack · GHSA-625h-95r8-8xpm

critical2025-09-25

CVE-2025-59823-Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning

gardener/gardener-extension-provider-aws · GHSA-227x-7mh8-3cf6

medium2025-09-25

CVE-2025-10951-ml-logger has path traversal in the file argument

geyang/ml-logger · GHSA-8x9j-2p8r-7xc6

high2025-09-25

CVE-2025-57317-apidoc-core is vulnerable to prototype pollution

apidoc/apidoc-core · GHSA-5q53-78f2-6gf8

low2025-09-25

CVE-2025-10950-ml-logger deserialization vulnerability

geyang/ml-logger · GHSA-57hm-8rjv-498w

medium2025-09-24

CVE-2025-59426-lobe-chat has an Open Redirect

lobehub/lobe-chat · GHSA-xph5-278p-26qx

high2025-09-24

CVE-2025-57323-mpregular vulnerable to prototype pollution

regularjs/regular · GHSA-xx4g-r65p-3qf2

high2025-09-24

CVE-2025-57318-csvjson vulnerable to prototype injection

pradeep-mishra/csvjson · GHSA-xq4f-3jxp-qv6m

low2025-09-24

CVE-2025-57349-messageformat has a prototype pollution vulnerability

messageformat/messageformat · GHSA-xfqm-j7pc-xrfc

medium2025-09-24

CVE-2025-55178-Llama Stack could potentially allow for remote code execution

llamastack/llama-stack · GHSA-x75h-m6jj-6cj2

low2025-09-24

CVE-2025-57327-spmrc vulnerable to prototype pollution

spmjs/spmrc · GHSA-r2rv-8pp3-65xw

low2025-09-24

CVE-2025-57330-web3-core-subscriptions has a Prototype Pollution vulnerability

web3/web3.js · GHSA-hhf6-3xpg-pggx

medium2025-09-24

CVE-2025-57351-ts-fns has prototype pollution vulnerability

tangshuang/ts-fns · GHSA-g7wq-wggw-vmhg

low2025-09-24

CVE-2025-57321-magix-combine-ex vulnerable to prototype pollution

thx/magix-combine · GHSA-cr7h-93fh-whwm

medium2025-09-24

CVE-2025-57324-parse is vulnerable to prototype pollution

parse-community/parse-sdk-js · GHSA-9g8m-v378-pcg3

low2025-09-24

CVE-2025-57348-node-cube vulnerable to prototype pollution

node-cube/cube · GHSA-8v65-5fw5-23wj