Security advisories

critical2025-09-03

CVE-2025-58367-DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more

seperman/deepdiff · GHSA-mw26-5g2v-hqw3

medium2025-09-03

CVE-2025-9824-Mautic Vulnerable to User Enumeration via Response Timing

mautic/mautic · GHSA-3ggv-qwcp-j6xg

medium2025-09-03

CVE-2025-9823-Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add

mautic/mautic · GHSA-9v8p-m85m-f7mm

medium2025-09-03

CVE-2025-9822-Mautic vulnerable to secret data extraction via elfinder

mautic/mautic · GHSA-438m-6mhw-hq5w

low2025-09-03

CVE-2025-9821-Mautic vulnerable to SSRF via webhook function

mautic/mautic · GHSA-hj6f-7hp7-xg69

high2025-09-03

CVE-2025-58362-Hono's flaw in URL path parsing could cause path confusion

honojs/hono · GHSA-9hp6-4448-45g2

medium2025-09-03

CVE-2025-58359-frost-core: refresh shares with smaller min_signers will reduce security of group

zcashfoundation/frost · GHSA-wgq8-vr6r-mqxm

medium2025-09-03

CVE-2025-55305-Electron has ASAR Integrity Bypass via resource modification

electron/electron · GHSA-vmqv-hx8q-j7mg

high2025-09-03

Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning

anthropics/claude-code · GHSA-ph6w-f82w-28w6

low2025-09-03

CVE-2025-58064-CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package

ckeditor/ckeditor5 · GHSA-x9gp-vjh6-3wv6

medium2025-09-03

CVE-2025-58057-Netty's decoders vulnerable to DoS via zip bomb style attack

netty/netty · GHSA-3p8m-j85q-pgmj

critical2025-09-03

CVE-2025-55748-XWiki configuration files can be accessed through jsx and sx endpoints

xwiki/xwiki-platform · GHSA-m63c-3rmg-r2cf

critical2025-09-03

CVE-2025-55747-XWiki configuration files can be accessed through the webjars API

xwiki/xwiki-platform · GHSA-qww7-89xh-x7m7

medium2025-09-03

CVE-2025-58459-Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated

jenkinsci/global-build-stats-plugin · GHSA-gm8g-fh49-qq6v

medium2025-09-03

CVE-2025-58458-Jenkins Git client Plugin file system information disclosure vulnerability

jenkinsci/git-client-plugin · GHSA-g2pq-9jr7-w6gv

medium2025-09-03

CVE-2025-58460-Jenkins OpenTelemetry Plugin missing permission check allows capturing credentials

jenkinsci/opentelemetry-plugin · GHSA-f696-867g-2759

low2025-09-03

CVE-2024-43166-Apache DolphinScheduler Incorrect Default Permissions Vulnerability

apache/dolphinscheduler · GHSA-rrpj-r8h7-rm7r

high2025-09-02

CVE-2025-58355-Soft Serve vulnerable to arbitrary file writing through SSH API

charmbracelet/soft-serve · GHSA-33pr-m977-5w97

high2025-09-02

CVE-2025-58358-mcp-markdownify-server vulnerable to command injection in pptx-to-markdown tool

zcaceres/markdownify-mcp · GHSA-45qj-4xq3-3c45

medium2025-09-02

ArrayQueue's push_front is not panic-safe

raviqqe/array-queue · GHSA-xqjr-wfx3-gmxv