Security advisories

medium2025-06-30

CVE-2025-52997-File Browser vulnerable to insecure password handling

filebrowser/filebrowser · GHSA-cm2r-rg7r-p7gg

low2025-06-30

CVE-2025-52996-File Browser's password protection of links is bypassable

filebrowser/filebrowser · GHSA-3v48-283x-f2w4

high2025-06-30

CVE-2025-52995-File Browser vulnerable to command execution allowlist bypass

filebrowser/filebrowser · GHSA-w7qc-6grj-w7r8

high2025-06-30

CVE-2025-52904-File Browser: Command Execution not Limited to Scope

filebrowser/filebrowser · GHSA-hc8f-m8g5-8362

medium2025-06-30

CVE-2025-52901-File Browser allows sensitive data to be transferred in URL

filebrowser/filebrowser · GHSA-rmwh-g367-mj4x

high2025-06-30

CVE-2024-49365-tiny-secp256k1 allows for verify() bypass when running in bundled environment

bitcoinjs/tiny-secp256k1 · GHSA-5vhg-9xg4-cv9m

high2025-06-30

CVE-2024-49364-tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment

bitcoinjs/tiny-secp256k1 · GHSA-7mc2-6phr-23xc

low2025-06-29

CVE-2025-6855-Langchain-Chatchat vulnerable to path traversal

chatchat-space/langchain-chatchat · GHSA-f823-phmg-x5fr

low2025-06-29

CVE-2025-6854-Langchain-Chatchat vulnerable to path traversal

chatchat-space/langchain-chatchat · GHSA-8v8h-4pjx-rg73

low2025-06-29

CVE-2025-6853-Langchain-Chatchat has a Path Traversal vulnerability

chatchat-space/langchain-chatchat · GHSA-qmgv-j263-qr33

medium2025-06-29

CVE-2025-53393-akka-cluster-metrics uses Java serialization for cluster metrics

akka/akka · GHSA-358m-fq53-hp87

low2025-06-28

CVE-2025-32897-Apache Seata Vulnerable to Deserialization of Untrusted Data

apache/incubator-seata · GHSA-m964-fjrh-xxq2

low2025-06-27

Taylor has race condition in /get-patch that allows purchase token replay

tailot/taylored · GHSA-vh5j-5fhq-9xwg

medium2025-06-27

CVE-2025-6773-HKUDS LightRAG allows Path Traversal via function upload_to_input_dir

hkuds/lightrag · GHSA-v9w6-9hq9-33ch

high2025-06-27

CVE-2025-53093-TabberNeue vulnerable to Stored XSS through wikitext

starcitizentools/mediawiki-extensions-tabberneue · GHSA-jfj7-249r-7j2m

high2025-06-27

CVE-2024-54000-MobSF vulnerability allows SSRF due to the allow_redirects=True parameter

mobsf/mobile-security-framework-mobsf · GHSA-m435-9v6r-v5f6

medium2025-06-27

mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data

go-viper/mapstructure · GHSA-fv92-fjc5-jj9h

high2025-06-27

CVE-2025-44163-raspap-webgui has a Directory Traversal vulnerability

raspap/raspap-webgui · GHSA-277f-37gw-9gmq

high2025-06-27

CVE-2025-53002-LLaMA-Factory allows Code Injection through improper vhead_file safeguards

hiyouga/llama-factory · GHSA-xj56-p8mm-qmxj

high2025-06-27

CVE-2025-52999-jackson-core can throw a StackoverflowError when processing deeply nested data

fasterxml/jackson-core · GHSA-h46c-h94j-95f3