Security advisories

critical2025-07-21

Nokogiri patches vendored libxml2 to resolve multiple CVEs

sparklemotion/nokogiri · GHSA-353f-x4gh-cqq8

medium2025-07-21

CVE-2025-54121-Starlette has possible denial-of-service vector when parsing large files in multipart forms

encode/starlette · GHSA-2c2j-9gv5-cj73

high2025-07-21

Dolibarr has Remote Code Execution Vulnerability (Bypass)

dolibarr/dolibarr · GHSA-49xw-hw94-fmv2

high2025-07-21

RageAgainstThePixel/setup-steamcmd leaked authentication token in job output logs

rageagainstthepixel/setup-steamcmd · GHSA-c5qx-p38x-qf5w

high2025-07-21

buildalon/setup-steamcmd leaked authentication token in job output logs

buildalon/setup-steamcmd · GHSA-mj96-mh85-r574

critical2025-07-21

CVE-2025-54082-nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability

marshmallow-packages/nova-tiptap · GHSA-96c2-h667-9fxp

critical2025-07-21

CVE-2025-7783-form-data uses unsafe random function in form-data for choosing boundary

form-data/form-data · GHSA-fjxv-7rqg-78g4

medium2025-07-21

CVE-2025-7962-Jakarta Mail vulnerable to SMTP Injection

eclipse-ee4j/angus-mail · GHSA-9342-92gg-6v29

high2025-07-21

Alchemy Non-SMA and Webauthn Account Security Advisory

alchemyplatform/modular-account · GHSA-56r6-ccm5-8hg3

high2025-07-21

CVE-2025-53832-@translated/lara-mcp vulnerable to command injection in import_tmx tool

translated/lara-mcp · GHSA-xj5p-8h7g-76m7

high2025-07-21

CVE-2025-53528-Cadwyn vulnerable to XSS on the docs page

zmievsa/cadwyn · GHSA-2gxp-6r36-m97r

high2025-07-21

CVE-2025-50151-Apache Jena doesn't validate file access paths in configuration files uploaded by users with administrator access

apache/jena · GHSA-xg9p-p463-3qjp

medium2025-07-21

CVE-2025-49656-Apache Jena allows users with administrator access to create databases files outside the files area of the Fuseki server

apache/jena · GHSA-jq2c-m8gg-mqcm

high2025-07-20

CVE-2025-54075-Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering

nuxt-modules/mdc · GHSA-cj6r-rrr9-fg82

low2025-07-20

CVE-2025-7885-WebSSH Cross-site Scripting vulnerability

huashengdun/webssh · GHSA-9cg4-9hv5-3376

high2025-07-19

CVE-2025-54313-eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

prettier/eslint-config-prettier · GHSA-f29h-pxvx-f335

low2025-07-18

@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser

eslint/rewrite · GHSA-xffm-g5w8-qvg7

medium2025-07-18

CVE-2025-54059-melange's world-writable permissions expose SBOM files to potential image tampering

chainguard-dev/melange · GHSA-5662-cv6m-63wh

high2025-07-18

CVE-2025-53945-apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files

chainguard-dev/apko · GHSA-x6ph-r535-3vjw

low2025-07-18

CVE-2025-53901-Wasmtime CLI is vulnerable to host panic through its fd_renumber function

bytecodealliance/wasmtime · GHSA-fm79-3f68-h2fc