Security advisories

low2025-07-07

CVE-2025-3777-Transformers's Improper Input Validation vulnerability can be exploited through username injection

huggingface/transformers · GHSA-phhr-52qp-3mj4

medium2025-07-07

CVE-2025-3044-LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions

run-llama/llama_index · GHSA-p7j4-jwjf-5x9w

medium2025-07-07

CVE-2025-3264-Transformers vulnerable to ReDoS attack through its get_imports() function

huggingface/transformers · GHSA-jjph-296x-mrcr

high2025-07-07

CVE-2025-3046-LlamaIndex is vulnerable to Path Traversal attack through its ObsidianReader class

run-llama/llama_index · GHSA-fmrf-6jv9-qjc7

medium2025-07-07

CVE-2025-3262-Transformers vulnerable to ReDoS attack through its SETTING_RE variable

huggingface/transformers · GHSA-489j-g2vx-39wf

medium2025-07-07

CVE-2025-3108-LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component

run-llama/llama_index · GHSA-m84c-4c34-28gf

medium2025-07-05

CVE-2025-53604-Rust Web Push is vulnerable to a DoS attack via a large integer in a Content-Length header

pimeys/rust-web-push · GHSA-287x-9rff-qvcg

high2025-07-04

CVE-2025-53366-MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS

modelcontextprotocol/python-sdk · GHSA-3qhf-m339-9g5v

high2025-07-04

CVE-2025-53365-MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service

modelcontextprotocol/python-sdk · GHSA-j975-95f5-7wqh

medium2025-07-04

CVE-2025-53602-Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint

openzipkin/zipkin · GHSA-794x-8x6x-qpfc

medium2025-07-04

CVE-2025-7053-Cockpit - Content Platform vulnerable to XSS through name or email argument names

cockpit-hq/cockpit · GHSA-j4rj-fgcq-wmqp

high2025-07-03

CVE-2025-53369-Citizen Short Description stored XSS vulnerability through wikitext

starcitizentools/mediawiki-extensions-shortdescription · GHSA-p85q-mww9-gwqf

high2025-07-03

CVE-2025-34086-Bolt CMS vulnerable to authenticated remote code execution

bolt/bolt · GHSA-p9qc-8jjx-g8cg

high2025-07-03

CVE-2025-53370-Citizen vulnerable to Stored XSS through short descriptions

starcitizentools/mediawiki-skins-citizen · GHSA-prmv-7r8c-794g

high2025-07-03

CVE-2025-49826-Next.JS vulnerability can lead to DoS via cache poisoning

vercel/next.js · GHSA-67rr-84xm-4c7r

low2025-07-03

CVE-2025-49005-Next.js has a Cache poisoning vulnerability due to omission of the Vary header

vercel/next.js · GHSA-r2fc-ccr8-96c4

high2025-07-03

CVE-2025-53368-starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions

starcitizentools/mediawiki-skins-citizen · GHSA-rq6g-6g94-jfr4

medium2025-07-03

CVE-2025-52554-n8n is vulnerable to Improper Authorization through its `/stop` endpoint

n8n-io/n8n · GHSA-gq57-v332-7666

medium2025-07-03

CVE-2025-48939-tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

amauric/tarteaucitron.js · GHSA-q43x-79jr-cq98

high2025-07-03

eKuiper /config/uploads API arbitrary file writing may lead to RCE

lf-edge/ekuiper · GHSA-gj54-gwj9-x2c6