Security advisories

critical2025-08-14

CVE-2025-24293-Active Storage allowed transformation methods that were potentially unsafe

rails/rails · GHSA-r4mg-4433-c7g3

medium2025-08-14

CVE-2025-55198-Helm May Panic Due To Incorrect YAML Content

helm/helm · GHSA-f9f8-9pmf-xv68

medium2025-08-14

CVE-2025-55199-Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

helm/helm · GHSA-9h84-qmv7-982p

medium2025-08-13

swift-nio-http2 affected by HTTP/2 MadeYouReset vulnerability

apple/swift-nio-http2 · GHSA-xvr7-p2c6-j83w

critical2025-08-13

m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials

boldestdungeon/steam-workshop-deploy · GHSA-x6gv-2rvh-qmp6

medium2025-08-13

CVE-2025-55193-Active Record logging vulnerable to ANSI escape injection

rails/rails · GHSA-76r7-hhxj-r776

critical2025-08-13

CVE-2011-10019-Spree has Remote Command Execution vulnerability in search functionality

spree/spree · GHSA-97vm-c39p-jr86

medium2025-08-13

CVE-2025-55197-PyPDF's Manipulated FlateDecode streams can exhaust RAM

py-pdf/pypdf · GHSA-7hfw-26vp-jp8m

high2025-08-13

CVE-2025-55196-External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access

external-secrets/external-secrets · GHSA-fcxq-v2r3-cc8h

high2025-08-13

CVE-2025-55163-Netty affected by MadeYouReset HTTP/2 DDoS vulnerability

netty/netty · GHSA-prj3-ccx8-p6x4

medium2025-08-13

CVE-2025-54791-OMERO.web displays unecessary user information when requesting password reset

ome/omero-web · GHSA-gpmg-4x4g-mr5r

high2025-08-13

CVE-2025-50946-OliveTin OS Command Injection vulnerability

olivetin/olivetin · GHSA-p3qf-84rg-jxfc

high2025-08-13

CVE-2025-52392-Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms

soosyze/soosyze · GHSA-vq9x-w82r-rhmc

high2025-08-13

CVE-2025-48989-Apache Tomcat Improper Resource Shutdown or Release vulnerability

apache/tomcat · GHSA-gqp3-2cvr-x8m3

medium2025-08-13

CVE-2025-55668-Apache Tomcat Session Fixation vulnerability

apache/tomcat · GHSA-23hv-mwm6-g8jf

medium2025-08-13

CVE-2025-8916-Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

bcgit/bc-java · GHSA-4cx2-fc23-5wg6

medium2025-08-12

CVE-2025-43734-Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

liferay/liferay-portal · GHSA-m5c7-5gv3-hcpf

medium2025-08-12

CVE-2025-55166-svg-sanitizer Bypasses Attribute Sanitization

darylldoyle/svg-sanitizer · GHSA-22wq-q86m-83fh

high2025-08-12

CVE-2025-8747-Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality

keras-team/keras · GHSA-c9rc-mg46-23w3

high2025-08-12

CVE-2025-49554-Magento vulnerable to denial of service

magento/magento2 · GHSA-xgfm-992v-h2hr