Security advisories

high2025-09-05

CVE-2025-58437-Coder vulnerable to privilege escalation could lead to a cross workspace compromise

coder/coder · GHSA-j6xf-jwrj-v5qp

low2025-09-05

CVE-2025-57807-ImageMagick BlobStream Forward-Seek Under-Allocation

imagemagick/imagemagick · GHSA-23hg-53q6-hqfg

high2025-09-05

CVE-2025-9636-pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability

pgadmin-org/pgadmin4 · GHSA-6859-2qxq-ffv2

high2025-09-05

CVE-2025-55671-TkEasyGUI Affected by Uncontrolled Search Path Element Issue

kujirahand/tkeasygui-python · GHSA-ph2w-cx28-vhrq

critical2025-09-05

CVE-2025-55037-TkEasyGUI Vulnerable to OS Command Injection

kujirahand/tkeasygui-python · GHSA-hfrj-3w3g-jv32

high2025-09-04

CVE-2025-9566-podman kube play symlink traversal vulnerability

containers/podman · GHSA-wp3j-xq48-xpjw

medium2025-09-04

CVE-2025-51586-Presta Shop vulnerable to email enumeration

prestashop/prestashop · GHSA-8xx5-h6m3-jr33

critical2025-09-04

CVE-2025-55190-Argo CD's Project API Token Exposes Repository Credentials

argoproj/argo-cd · GHSA-786q-9hcg-v9ff

high2025-09-04

CVE-2025-58179-Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter

withastro/astro · GHSA-qpr4-c339-7vq8

critical2025-09-04

Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution

pixaranimationstudios/openusd · GHSA-58p5-r2f6-g2cj

low2025-09-04

CVE-2025-58056-Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions

netty/netty · GHSA-fghv-69vj-qj49

medium2025-09-04

Vaadin Platform possible file bypass via upload validation on the server-side

vaadin/platform · GHSA-c7v7-rqfm-f44j

medium2025-09-04

Vaadin Flow Components possible file bypass via upload validation on the server-side

vaadin/flow-components · GHSA-94g8-xv23-7656

medium2025-09-04

CVE-2025-9467-Vaadin Framework possible file bypass via upload validation on the server-side

vaadin/framework · GHSA-9gfh-4fwj-w3rj

medium2025-09-04

CVE-2025-56761-Memos Vulnerable to Stored Cross-Site Scripting

usememos/memos · GHSA-cgrg-86m5-xm4w

medium2025-09-04

CVE-2025-56760-Memos Vulnerable to Path Traversal via the CreateResource Endpoint

usememos/memos · GHSA-78j5-8vq7-jxv5

low2025-09-04

PyPI publish GitHub Action vulnerable to injectable expression expansions in action steps

pypa/gh-action-pypi-publish · GHSA-vxmw-7h4f-hqxh

low2025-09-04

CVE-2025-58352-Weblate has a long session expiry when verifying second factor

weblateorg/weblate · GHSA-377j-wj38-4728

high2025-09-04

CVE-2025-6984-Langchain Community Vulnerable to XML External Entity (XXE) Attacks

langchain-ai/langchain-community · GHSA-pc6w-59fv-rh23

high2025-09-04

CVE-2025-43772-Liferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin

liferay/liferay-portal · GHSA-j4fw-4mhr-hc45