Security advisories

high2025-07-03

LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement

lf-edge/ekuiper · GHSA-fv2p-qj5p-wqq4

medium2025-07-03

CVE-2025-49595-n8n Vulnerable to Denial of Service via Malformed Binary Data Requests

n8n-io/n8n · GHSA-pr9r-gxgp-9rm8

medium2025-07-02

CVE-2025-34076-Microweber CMS API has authenticated local file inclusion vulnerability

microweber/microweber · GHSA-j64v-xh5w-8hqj

medium2025-07-02

CVE-2025-34075-HashiCorp Vagrant has code injection vulnerability through default synced folders

hashicorp/vagrant · GHSA-hqp6-mjw3-f586

medium2025-07-02

CVE-2025-53359-ethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactions

rust-ethereum/ethereum · GHSA-3w94-vq2x-v5wr

medium2025-07-01

CVE-2025-53103-junit-platform-reporting can leak Git credentials through its OpenTestReportGeneratingListener

junit-team/junit-framework · GHSA-m43g-m425-p68x

high2025-07-01

CVE-2025-53110-@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix

modelcontextprotocol/servers · GHSA-hc55-p739-j48w

high2025-07-01

CVE-2025-53109-@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling

modelcontextprotocol/servers · GHSA-q66q-fx2p-7w4m

medium2025-07-01

CVE-2025-6224-juju/utils leaks private key in certs

juju/utils · GHSA-h34r-jxqm-qgpr

high2025-07-01

CVE-2025-48379-Pillow vulnerability can cause write buffer overflow on BCn encoding

python-pillow/pillow · GHSA-xg8h-j46f-w952

high2025-06-30

CVE-2025-53106-Graylog vulnerable to privilege escalation through API tokens

graylog2/graylog2-server · GHSA-3m86-c9x3-vwm9

high2025-06-30

CVE-2025-53107-@cyanheads/git-mcp-server vulnerable to command injection in several tools

cyanheads/git-mcp-server · GHSA-3q26-f695-pp76

medium2025-06-30

CVE-2024-46993-Electron vulnerable to Heap Buffer Overflow in NativeImage

electron/electron · GHSA-6r2x-8pq8-9489

medium2025-06-30

CVE-2025-47871-Mattermost Incorrect Authorization vulnerability

mattermost/mattermost · GHSA-wgvp-jj4w-88hf

medium2025-06-30

CVE-2025-46702-Mattermost Incorrect Authorization vulnerability

mattermost/mattermost · GHSA-v8fr-vxmw-6mf6

low2025-06-30

CVE-2025-45143-string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)

devrafalko/string-math · GHSA-994j-5c83-r424

critical2025-06-30

CVE-2025-26074-Conductor vulnerable to OS command injection through unrestricted access to Java classes

conductor-oss/conductor · GHSA-8gqp-hr9g-pg62

high2025-06-30

CVE-2024-46992-electron ASAR Integrity bypass by just modifying the content

electron/electron · GHSA-xw5q-g62x-2qjc

high2025-06-30

Babylon vulnerable to chain half when transaction has fees different than `ubbn`

babylonlabs-io/babylon · GHSA-56j4-446m-qrf6

high2025-06-30

CVE-2025-53003-Janssen Config API returns results without scope verification

janssenproject/jans · GHSA-373j-mhpf-84wg