Security advisories

high2025-09-02

CVE-2025-58178-Command Injection via sonarqube-scan-action GitHub Action

sonarsource/sonarqube-scan-action · GHSA-f79p-9c5r-xg88

high2025-09-02

arenavec has multiple memory corruption vulnerabilities in safe APIs

ibabushkin/arenavec · GHSA-3632-54q8-m96x

low2025-09-02

CVE-2025-58161-MobSF Path Traversal in GET /download/<filename> using absolute filenames

mobsf/mobile-security-framework-mobsf · GHSA-ccc3-fvfx-mw3v

medium2025-09-02

CVE-2025-58162-MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

mobsf/mobile-security-framework-mobsf · GHSA-9gh8-9r95-3fc3

high2025-09-02

PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking

pmmp/pocketmine-mp · GHSA-fqqv-56h5-f57g

high2025-09-02

CVE-2025-57808-ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

esphome/esphome · GHSA-mxh2-ccgj-8635

medium2025-09-02

CVE-2025-57806-Local Deep Research's API keys are stored in plain text

learningcircuit/local-deep-research · GHSA-4h8c-qrcq-cv5c

medium2025-09-02

CVE-2025-46047-Silverpeas Core Username Enumeration Vulnerability

silverpeas/silverpeas-core · GHSA-cv2m-5pfp-f245

high2025-09-02

CVE-2025-9784-Undertow MadeYouReset HTTP/2 DDoS Vulnerability

undertow-io/undertow · GHSA-95h4-w6j8-2rp8

medium2025-08-29

CVE-2025-57752-Next.js Affected by Cache Key Confusion for Image Optimization API Routes

vercel/next.js · GHSA-g5qg-72qw-gw5v

medium2025-08-29

CVE-2025-55173-Next.js Content Injection Vulnerability for Image Optimization

vercel/next.js · GHSA-xv57-4mr9-wg8v

medium2025-08-29

CVE-2025-57822-Next.js Improper Middleware Redirect Handling Leads to SSRF

vercel/next.js · GHSA-4342-x723-ch2f

medium2025-08-29

CVE-2025-43773-Liferay Portal allows improper access through the expandoTableLocalService

liferay/liferay-portal · GHSA-876g-49r6-33qj

low2025-08-29

CVE-2025-58160- Tracing logging user input may result in poisoning logs with ANSI escape sequences

tokio-rs/tracing · GHSA-xwfj-jgwm-7wp5

high2025-08-29

CVE-2024-52284-Rancher Fleet Helm Values are stored inside BundleDeployment in plain text

rancher/fleet · GHSA-6h9x-9j5v-7w9h

medium2025-08-29

webp crate may expose memory contents when encoding an image

jaredforth/webp · GHSA-9q78-27f3-2jmh

medium2025-08-29

CVE-2025-47909-github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks

gorilla/csrf · GHSA-82ff-hg59-8x73

high2025-08-29

CVE-2025-58157-gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm

consensys/gnark · GHSA-9fvj-xqr2-xwg8

medium2025-08-29

CVE-2025-58068-Eventlet affected by HTTP request smuggling in unparsed trailers

eventlet/eventlet · GHSA-hw6f-rjfj-j7j7

medium2025-08-29

CVE-2025-58067-Google Sign-In for Rails allowed redirect to protocol-relative URI

basecamp/google_sign_in · GHSA-5jch-xhw4-r43v