Security advisories

high2025-08-08

CVE-2025-54996-OpenBao Root Namespace Operator May Elevate Token Privileges

openbao/openbao · GHSA-vf84-mxrq-crqc

high2025-08-08

CVE-2025-54888-@fedify/fedify has Improper Authentication and Incorrect Authorization

fedify-dev/fedify · GHSA-6jcc-xgcr-q3h4

medium2025-08-08

CVE-2025-48913-Apache CXF: Untrusted JMS configuration can lead to RCE

apache/cxf · GHSA-g4px-6qhm-hqjm

high2025-08-08

CVE-2025-53606-Apache Seata: Deserialization of untrusted Data in Apache Seata Server

apache/incubator-seata · GHSA-g358-g2pq-c46j

critical2025-08-08

CVE-2025-54951-ExecuTorch vulnerable to Heap-based Buffer Overflow

pytorch/executorch · GHSA-xc7w-r669-48pf

critical2025-08-08

CVE-2025-30404-ExecuTorch integer overflow vulnerability

pytorch/executorch · GHSA-hj95-mhgf-jxc4

critical2025-08-08

CVE-2025-54950-ExecuTorch out-of-bounds access vulnerability

pytorch/executorch · GHSA-f9hx-c6jf-3qxm

critical2025-08-08

CVE-2025-54949-ExecuTorch heap buffer overflow vulnerability

pytorch/executorch · GHSA-9m39-3mf3-xwch

critical2025-08-08

CVE-2025-30405-ExecuTorch integer overflow vulnerability

pytorch/executorch · GHSA-84m3-f99p-cqx5

medium2025-08-08

CVE-2025-54952-ExecuTorch integer overflow vulnerability leads to code execution

pytorch/executorch · GHSA-33r8-vrx9-rmcv

medium2025-08-07

CVE-2025-7195-operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

operator-framework/operator-sdk · GHSA-856v-8qm2-9wjv

critical2025-08-07

CVE-2025-54887-JWE is missing AES-GCM authentication tag validation in encrypted JWE

jwt/ruby-jwe · GHSA-c7p4-hx26-pr73

high2025-08-07

CVE-2025-7054-quiche connection ID retirement can trigger an infinite loop

cloudflare/quiche · GHSA-m3hh-f9gh-74c2

medium2025-08-07

CVE-2025-54368-uv allows ZIP payload obfuscation through parsing differentials

astral-sh/uv · GHSA-8qf3-x8v5-2pj8

medium2025-08-07

CVE-2025-44779-Ollama allows deletion of arbitrary files

ollama/ollama · GHSA-93jv-pvg8-hf3v

high2025-08-07

CVE-2025-54886-SKOPS Card.get_model happily allows arbitrary code execution

skops-dev/skops · GHSA-378x-6p4f-8jgm

medium2025-08-07

CVE-2025-54793-Astros's duplicate trailing slash feature leads to an open redirection security issue

withastro/astro · GHSA-cq8c-xv66-36gw

medium2025-08-06

CVE-2025-54885-The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended

simbo1905/thinbus-srp-npm · GHSA-8q6v-474h-whgg

low2025-08-06

CVE-2025-54799-github.com/go-acme/lego/v4/acme/api does not enforce HTTPS

go-acme/lego · GHSA-q82r-2j7m-9rv4

low2025-08-06

CVE-2025-54798-tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter

raszi/node-tmp · GHSA-52f5-9888-hmc6