Security advisories

high2025-07-09

CVE-2025-0928-Juju allows arbitrary executable uploads via authenticated endpoint without authorization

juju/juju · GHSA-4vc8-wvhw-m5gv

medium2025-07-09

CVE-2025-53512-Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization

juju/juju · GHSA-r64v-82fh-xc63

critical2025-07-09

CVE-2025-6514-mcp-remote exposed to OS command injection via untrusted MCP server connections

geelen/mcp-remote · GHSA-6xpm-ggf7-wc3p

high2025-07-09

CVE-2025-53513-Juju zip slip vulnerability via authenticated endpoint

juju/juju · GHSA-24ch-w38v-xmh8

high2025-07-08

Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt

cosmos/cosmos-sdk · GHSA-p22h-3m2v-cmgh

high2025-07-08

CVE-2025-53547-Helm vulnerable to Code Injection through malicious chart.yaml content

helm/helm · GHSA-557j-xg8c-q2mm

high2025-07-08

CVE-2025-7346-pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages

pyload/pyload · GHSA-x698-5hjm-w2m5

high2025-07-08

CVE-2025-53355-MCP Server Kubernetes vulnerable to command injection in several tools

flux159/mcp-server-kubernetes · GHSA-gjv4-ghm7-q58q

high2025-07-08

Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary

babylonlabs-io/babylon · GHSA-rj53-j6jw-7f7g

medium2025-07-08

CVE-2025-59427-Cloudflare Vite plugin exposes secrets over the built-in dev server

cloudflare/workers-sdk · GHSA-4pfg-2mw5-f8jx

high2025-07-08

CVE-2025-53372-Node.js Sandbox MCP Server vulnerability can lead to Sandbox Escape via Command Injection

alfonsograziano/node-code-sandbox-mcp · GHSA-5w57-2ccq-8w95

medium2025-07-07

CVE-2025-53539-fastapi-guard is vulnerable to ReDoS through inefficient regex

rennf93/fastapi-guard · GHSA-j47q-rc62-w448

low2025-07-07

CVE-2025-53535-Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes

better-auth/better-auth · GHSA-36rg-gfq2-3h56

medium2025-07-07

CVE-2023-51232-Dagster vulnerable to Path Traversal attack through its /logs endpoint

dagster-io/dagster · GHSA-q93c-p2mw-p23f

high2025-07-07

CVE-2025-6209-LlamaIndex vulnerable to Path Traversal attack through its encode_image function

run-llama/llama_index · GHSA-2rhq-96q8-4vjq

high2025-07-07

CVE-2025-6386-Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function

parisneo/lollms · GHSA-j5pr-vrjj-9v4h

medium2025-07-07

CVE-2025-5472-LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing

run-llama/llama_index · GHSA-3wxx-q3gv-pvvv

medium2025-07-07

CVE-2025-6210-LlamaIndex vulnerability in its ObsidianReader class can lead to Path Traversal exploit

run-llama/llama_index · GHSA-3j8r-jf9w-5cmh

high2025-07-07

CVE-2025-3225-LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser

run-llama/llama_index · GHSA-w42r-mrx7-c633

medium2025-07-07

CVE-2025-3263-Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking

huggingface/transformers · GHSA-q2wp-rjmx-x6x9