Security advisories

medium2025-07-29

CVE-2025-50738-Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs

usememos/memos · GHSA-hfcf-79gh-f3jc

high2025-07-29

CVE-2025-8264-z-push/z-push-dev SQL Injection Vulnerability

z-hub/z-push · GHSA-w832-w3p8-cw29

low2025-07-28

CVE-2025-8283-Netavark Has Possible DNS Resolve Confusion

containers/netavark · GHSA-rpcf-rmh6-42xr

critical2025-07-28

CVE-2025-54419-Node-SAML SAML Signature Verification Vulnerability

node-saml/node-saml · GHSA-4mxg-3p6v-xgq3

medium2025-07-28

CVE-2025-54423-copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata

9001/copyparty · GHSA-9q4r-x2hj-jmvr

medium2025-07-28

CVE-2025-54590-webfinger.js Blind SSRF Vulnerability

silverbucket/webfinger.js · GHSA-8xq3-w9fx-74rv

critical2025-07-28

CVE-2025-54418-CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

codeigniter4/codeigniter4 · GHSA-9952-gv64-x94c

critical2025-07-27

CVE-2025-5120-smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module

huggingface/smolagents · GHSA-6v92-r5mx-h5fx

high2025-07-26

CVE-2025-8101-Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)

nfrasser/linkifyjs · GHSA-95jq-xph2-cx9h

medium2025-07-25

CVE-2025-54380-Opencast still publishes global system account credentials

opencast/opencast · GHSA-j63h-hmgw-x4j7

critical2025-07-25

CVE-2025-54416-tj-actions/branch-names has a Command Injection Vulnerability

tj-actions/branch-names · GHSA-gq52-6phf-x2r6

high2025-07-25

CVE-2025-54413-Skops may allow MethodNode to access unexpected object fields through dot notation, leading to arbitrary code execution at load time

skops-dev/skops · GHSA-4v6w-xpmh-gfgp

high2025-07-25

CVE-2025-54412-Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution

skops-dev/skops · GHSA-m7f4-hrc6-fwg3

medium2025-07-25

CVE-2025-55013-Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code

cybercentrecanada/assemblyline-service-client · GHSA-75jv-vfxf-3865

high2025-07-25

CVE-2025-54385-XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API

xwiki/xwiki-platform · GHSA-p9qm-p942-q3w5

critical2025-07-25

CVE-2025-54369-Node-SAML SAML Authentication Bypass

node-saml/node-saml · GHSA-m837-g268-mmv7

high2025-07-24

CVE-2025-6998-Calibre Web and Autocaliweb have a ReDoS vulnerability

janeczku/calibre-web · GHSA-2g7m-ph9x-7q7m

critical2025-07-24

CVE-2025-32429-XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

xwiki/xwiki-platform · GHSA-vr59-gm53-v7cq

high2025-07-24

CVE-2025-54379-eKuiper API endpoints handling SQL queries with user-controlled table names.

lf-edge/ekuiper · GHSA-526j-mv3p-f4vv

high2025-07-23

CVE-2025-53015-ImageMagick has XMP profile write that triggers hang due to unbounded loop

imagemagick/imagemagick · GHSA-vmhh-8rxq-fp9g