Security advisories

low2025-09-24

CVE-2025-57326-sassdoc-extras vulnerable to prototype pollution

sassdoc/sassdoc-extras · GHSA-3mpm-jx38-9m8w

medium2025-09-24

CVE-2025-57320-json-schema-editor-visual vulnerable to prototype pollution

zyqwst/json-schema-editor-vue · GHSA-3c3p-xh4f-pfh7

low2025-09-24

CVE-2025-57328-toggle-array vulnerable to prototype pollution

jonschlinkert/toggle-array · GHSA-34q3-8x9v-j957

low2025-09-24

CVE-2025-57329-web3-core-method is vulnerable to prototype pollution

web3/web3.js · GHSA-2j4c-9qqq-896r

high2025-09-24

CVE-2025-59839-Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes

starcitizenwiki/mediawiki-extensions-embedvideo · GHSA-4j5h-mvj3-m48v

medium2025-09-24

CVE-2025-61685-Mastra Docs MCP Server `@mastra/mcp-docs-server` Leads to Information Exposure

mastra-ai/mastra · GHSA-xh92-rqrq-227v

critical2025-09-24

CVE-2025-59834-Command Injection in adb-mcp MCP Server

srmorete/adb-mcp · GHSA-54j7-grvr-9xwg

high2025-09-24

CVE-2025-59828-Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

anthropics/claude-code · GHSA-2jjv-qf24-vfm4

low2025-09-24

CVE-2025-59824-Omni Wireguard SideroLink potential escape

siderolabs/omni · GHSA-hqrf-67pm-wgfq

high2025-09-24

CVE-2025-59343-tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

mafintosh/tar-fs · GHSA-vj76-c3g6-qr5v

medium2025-09-24

CVE-2025-57354-counterpart vulnerable to prototype pollution

martinandert/counterpart · GHSA-2488-w585-72ch

medium2025-09-24

CVE-2025-57350-CSVTOJSON has a prototype pollution vulnerability

keyang/node-csvtojson · GHSA-vrw9-g62v-7fmf

low2025-09-24

CVE-2025-57352-min-document vulnerable to prototype pollution

raynos/min-document · GHSA-rx8g-88g5-qh64

medium2025-09-24

CVE-2025-57353-messageformat prototype pollution vulnerability

messageformat/messageformat · GHSA-6xv4-9cqp-92rh

low2025-09-24

CVE-2025-10909-Mangati NovoSGA XSS vulnerability in /admin

novosga/novosga · GHSA-4c44-r8rm-3p39

medium2025-09-24

CVE-2025-8869-pip's fallback tar extraction doesn't check symbolic links point to extraction directory

pypa/pip · GHSA-4xh5-x5gv-qwph

medium2025-09-24

CVE-2025-58457-Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

apache/zookeeper · GHSA-2hmj-97jw-28jh

medium2025-09-24

CVE-2025-48392-Apache IoTDB: DoS Vulnerability

apache/iotdb · GHSA-vx84-xvr8-w24c

critical2025-09-24

CVE-2025-48459-Apache IoTDB: Deserialization of untrusted Data

apache/iotdb · GHSA-776q-jw43-fhjx

medium2025-09-24

CVE-2025-43819-Liferay Portal and DXP does not properly expire sessions

liferay/liferay-portal · GHSA-rpx3-f938-xj5q