Security advisories

medium2025-08-29

CVE-2025-58066-DoS Vulnerability in ntpd-rs

pendulum-project/ntpd-rs · GHSA-4855-q42w-5vr4

high2025-08-29

CVE-2025-58158-Harness Allows Arbitrary File Write in Gitness LFS server

harness/harness · GHSA-w469-hj2f-jpr5

high2025-08-29

Versity panic induced by AWS chunked data sent to port

versity/versitygw · GHSA-v2ch-c8v8-fgr7

high2025-08-29

CVE-2024-58259-Rancher affected by unauthenticated Denial of Service

rancher/rancher · GHSA-4h45-jpvh-6p5j

low2025-08-29

CVE-2025-55202-Opencast has a partial path traversal vulnerability in UI config

opencast/opencast · GHSA-hq8m-v68g-8cf8

medium2025-08-29

CVE-2025-9654-AiondaDotCom mcp-ssh command injection vulnerability in SSH operations

aiondadotcom/mcp-ssh · GHSA-694p-3fxc-m92h

low2025-08-29

CVE-2025-55304-Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata

exiv2/exiv2 · GHSA-m54q-mm9w-fp6g

low2025-08-29

CVE-2025-54080-Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file

exiv2/exiv2 · GHSA-496f-x7cq-cq39

medium2025-08-29

CVE-2025-4643-Payload does not invalidate JWTs after log out

payloadcms/payload · GHSA-5v66-m237-hwf7

medium2025-08-29

CVE-2025-4644-Payload's SQLite adapter Session Fixation vulnerability

payloadcms/payload · GHSA-26rv-h2hf-3fw4

high2025-08-28

CVE-2025-6203-HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads

hashicorp/vault · GHSA-8f82-53h8-2p34

medium2025-08-28

CVE-2025-58058-github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives

ulikunitz/xz · GHSA-jc7w-c686-c4v9

low2025-08-28

Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token

coder/coder · GHSA-3rw9-wmc8-8948

high2025-08-28

Contrast leaks workload secrets to logs on INFO level

edgelesssys/contrast · GHSA-vxg3-w9rv-rhr2

critical2025-08-28

CVE-2025-58059-Valtimo scripting engine can be used to gain access to sensitive data or resources

valtimo-platform/valtimo-backend-libraries · GHSA-w48j-pp7j-fj55

high2025-08-28

CVE-2025-58047-Volto affected by possible DoS by invoking specific URL by anonymous user

plone/volto · GHSA-xjhf-7833-3pm5

medium2025-08-28

CVE-2025-56236-FormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability

formcms/formcms · GHSA-4fxf-xgrm-8fcj

medium2025-08-28

CVE-2025-58049-XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

xwiki/xwiki-platform · GHSA-9m7c-m33f-3429

medium2025-08-28

CVE-2025-57759-Contao does not properly manage privileges for page and article fields

contao/contao · GHSA-qqfq-7cpp-hcqj

medium2025-08-28

CVE-2025-57757-Contao can disclose sensitive information in the news module

contao/contao · GHSA-w53m-gxvg-vx7p