Security advisories

low2025-07-14

CVE-2025-53643- AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

aio-libs/aiohttp · GHSA-9548-qrrj-x5pj

medium2025-07-14

CVE-2025-53640-Indico vulnerability allows attackers to bulk dump user details

indico/indico · GHSA-q28v-664f-q6wj

critical2025-07-14

CVE-2025-53623-Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

shopify/job-iteration · GHSA-6qjf-g333-pv38

high2025-07-14

CVE-2025-53689-Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build

apache/jackrabbit · GHSA-44c3-38h8-9fh9

medium2025-07-14

CVE-2025-29606-py-libp2p is vulnerable to DoS attacks through use of large RSA keys

libp2p/py-libp2p · GHSA-x8c6-gj59-6rx8

medium2025-07-13

CVE-2025-53865-Roundup is vulnerable to XSS through interactions between URLs and issue tracker templates

roundup-tracker/roundup · GHSA-qxh9-qmf2-rhwc

high2025-07-12

CVE-2024-41169-Apache Zeppelin exposes server resources to unauthenticated attackers

apache/zeppelin · GHSA-7pgf-ppxw-8624

low2025-07-11

CVE-2025-7453-ZPan Uses Hard-Coded Password

saltbo/zpan · GHSA-2hfh-94w5-wxvf

low2025-07-11

static-alloc vulnerability leads to uninitialized read after allocating MemBump

197g/static-alloc · GHSA-xrrq-rrgq-h89w

high2025-07-11

CVE-2025-30402-ExecuTorch vulnerable to Heap-based Buffer Overflow attack

pytorch/executorch · GHSA-h952-963h-rv99

medium2025-07-11

Better Call routing bug can lead to Cache Deception

bekacru/better-call · GHSA-hq75-xg7r-rx6c

medium2025-07-11

CVE-2025-52994-phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

jamesheinrich/phpthumb · GHSA-q745-cfqh-hcrw

medium2025-07-11

CVE-2025-48924-Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs

apache/commons-lang · GHSA-j288-q9x7-2f5v

medium2025-07-11

CVE-2025-3933-Transformers is vulnerable to ReDoS attack through its DonutProcessor class

huggingface/transformers · GHSA-37mw-44qp-f5jm

high2025-07-10

CVE-2025-53506-Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams

apache/tomcat · GHSA-25xr-qj8w-c4vf

high2025-07-10

CVE-2025-52520-Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits

apache/tomcat · GHSA-wr62-c79q-cv37

medium2025-07-10

CVE-2025-52434-Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector

apache/tomcat · GHSA-4j3c-42xv-3f84

high2025-07-10

CVE-2025-53634-Chall-Manager's HTTP Gateway is vulnerable to DoS due to missing header timeout

ctfer-io/chall-manager · GHSA-ggmv-j932-q89q

high2025-07-10

CVE-2025-53633-Chall-Manager's scenario decoding process does not check for zip bombs

ctfer-io/chall-manager · GHSA-r7fm-3pqm-ww5w

high2025-07-10

CVE-2025-53632-Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive

ctfer-io/chall-manager · GHSA-3gv2-v3jx-r9fh