Security advisories

medium2025-07-30

CVE-2025-54656-Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability

apache/struts · GHSA-cx25-xg7c-xfm5

high2025-07-30

CVE-2025-54586-GitProxy Hidden Commits Injection

finos/git-proxy · GHSA-v98g-8rqx-g93g

high2025-07-30

CVE-2025-54585-GitProxy New Branch Approval Exploit

finos/git-proxy · GHSA-39p2-8hq9-fwj6

high2025-07-30

CVE-2025-54584-GitProxy Backfile Parsing Exploit

finos/git-proxy · GHSA-xxmh-rf63-qwjv

high2025-07-30

CVE-2025-54583-GitProxy Approval Bypass When Pushing Multiple Branches

finos/git-proxy · GHSA-qr93-8wwf-22g4

high2025-07-30

CVE-2025-54581-vproxy Divide by Zero DoS Vulnerability

0x676e67/vproxy · GHSA-7h24-c332-p48c

medium2025-07-30

CVE-2021-21411-OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0

oauth2-proxy/oauth2-proxy · GHSA-652x-m2gr-hppm

medium2025-07-30

CVE-2025-54575-SixLabors ImageSharp Has Infinite Loop in GIF Decoder When Skipping Malformed Comment Extension Blocks

sixlabors/imagesharp · GHSA-rxmq-m78w-7wmc

medium2025-07-30

CVE-2025-54572-Ruby SAML DOS vulnerability with large SAML response

saml-toolkits/ruby-saml · GHSA-rrqh-93c8-j966

medium2025-07-30

Pyload log Injection via API /json/add_package in add_name parameter

pyload/pyload · GHSA-3wwm-hjv7-23r3

medium2025-07-30

CVE-2025-7784-Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled)

keycloak/keycloak · GHSA-27gp-8389-hm4w

medium2025-07-30

CVE-2025-7365-Keycloak phishing attack via email verification step in first login flow

keycloak/keycloak · GHSA-xhpr-465j-7p9q

high2025-07-29

CVE-2025-52490-Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output

couchbase/sync_gateway · GHSA-pqhp-4xfc-hjgq

high2025-07-29

CVE-2025-45346-Bacula-web SQL Injection Vulnerability

bacula-web/bacula-web · GHSA-hq25-vp56-qr86

high2025-07-29

CVE-2025-54433-Bugsink path traversal via event_id in ingestion

bugsink/bugsink · GHSA-q78p-g86f-jg6q

low2025-07-29

CVE-2025-54410-Moby firewalld reload removes bridge network isolation

moby/moby · GHSA-4vq8-7jfc-9cvp

medium2025-07-29

CVE-2025-54388-Moby firewalld reload makes published container ports accessible from remote hosts

moby/moby · GHSA-x4rx-4gw3-53p4

critical2025-07-29

CVE-2025-54381-BentoML SSRF Vulnerability in File Upload Processing

bentoml/bentoml · GHSA-mrmq-3q62-6cc8

low2025-07-29

CVE-2025-8129-Koa Open Redirect via Referrer Header (User-Controlled)

koajs/koa · GHSA-jgmv-j7ww-jx2x

medium2025-07-29

CVE-2025-54425-Umbraco Delivery API allows for cached requests to be returned with an invalid API key

umbraco/umbraco-cms · GHSA-75vq-qvhr-7ffr