Security advisories

medium2025-08-06

CVE-2025-5197-Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability

huggingface/transformers · GHSA-9356-575x-2w9m

medium2025-08-06

CVE-2025-6013-HashiCorp Vault ldap auth method may not have correctly enforced MFA

hashicorp/vault · GHSA-7rx2-769v-hrwf

medium2025-08-06

CVE-2025-7954-Shopware race condition bypasses voucher restrictions

shopware/shopware · GHSA-27gv-mg7w-mm34

low2025-08-06

CVE-2025-8573-Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page

concretecms/concretecms · GHSA-c5xf-rmv4-j85h

medium2025-08-06

CVE-2025-8571-Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page

concretecms/concretecms · GHSA-4pcg-pjp5-3mc6

low2025-08-05

CVE-2025-54873-RISC Zero Underconstrained Vulnerability: Division

risc0/risc0 · GHSA-f6rc-24x4-ppxp

high2025-08-05

CVE-2025-54125-XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

xwiki/xwiki-platform · GHSA-57q2-6cp4-9mq3

high2025-08-05

CVE-2025-54124-XWiki leaks password hashes and other accessible password properties

xwiki/xwiki-platform · GHSA-r38m-cgpg-qj69

medium2025-08-05

CVE-2025-32430-XWiki allows Reflected XSS in two templates

xwiki/xwiki-platform · GHSA-m9x4-w7p9-mxhx

critical2025-08-05

CVE-2025-50706-ThinkPHP Path Traversal Vulnerability

top-think/framework · GHSA-mrwc-mvr8-9xq5

medium2025-08-05

CVE-2025-54869-FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service

setasign/fpdi · GHSA-jxhh-4648-vpp3

high2025-08-05

CVE-2025-54801-Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder

gofiber/fiber · GHSA-qx2q-88mx-vhg7

high2025-08-05

CVE-2025-54073-mcp-package-docs vulnerable to command injection in several tools

sammcj/mcp-package-docs · GHSA-vf9j-h32g-2764

medium2025-08-05

CVE-2025-4604-Liferay Portal CAPTCHA Bypass for Gogo Shell

liferay/liferay-portal · GHSA-3j6h-5v68-hvqg

high2025-08-04

CVE-2025-53534-RatPanel can perform remote command execution without authorization

tnborg/panel · GHSA-fm3m-jrgm-5ppg

medium2025-08-04

CVE-2025-54804-russh is missing overflow checks during channel windows adjust

eugeny/russh · GHSA-h5rc-j5f5-3gcm

high2025-08-04

CVE-2025-54803-js-toml Prototype Pollution Vulnerability

sunnyadn/js-toml · GHSA-65fc-cr5f-v7r2

critical2025-08-04

CVE-2025-54802-pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)

pyload/pyload · GHSA-48rp-jc79-2264

high2025-08-04

CVE-2025-54796-copyparty allows Regex Denial of Service (ReDoS) in the upload listing

9001/copyparty · GHSA-5662-2rj7-f2v6

high2025-08-04

CVE-2025-54795-Claude Code echo command allowed bypass of user approval prompt for command execution

anthropics/claude-code · GHSA-x56v-x2h6-7j34