Security advisories

high2025-06-27

CVE-2025-52903-filebrowser Allows Shell Commands to Spawn Other Commands

filebrowser/filebrowser · GHSA-3q2w-42mv-cph4

high2025-06-27

CVE-2025-52902-filebrowser allows Stored Cross-Site Scripting through the Markdown preview function

filebrowser/filebrowser · GHSA-4wx8-5gm2-2j97

medium2025-06-27

CVE-2025-52900-filebrowser Sets Insecure File Permissions

filebrowser/filebrowser · GHSA-jj2r-455p-5gvf

medium2025-06-27

CVE-2025-49592-n8n allows open redirects via the /signin endpoint

n8n-io/n8n · GHSA-5vj6-wjr7-5v9f

low2025-06-27

CVE-2025-6735-JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing Import Page component

juzaweb/cms · GHSA-rq7x-cfmc-rq3w

low2025-06-27

CVE-2025-6736-JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing certain components

juzaweb/cms · GHSA-mrph-pjv2-34f4

medium2025-06-27

CVE-2025-5731-Infinispan CLI vulnerable to Generation of Error Message Containing Sensitive Information

infinispan/infinispan · GHSA-cqm8-rg2p-jfcf

medium2025-06-26

CVE-2025-6442-Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling

ruby/webrick · GHSA-r995-q44h-hr64

medium2025-06-26

CVE-2025-49550-Magento Security feature bypass

magento/magento2 · GHSA-8hcx-xvww-6c6h

low2025-06-26

CVE-2025-49549-Magento Authenticated Security feature bypass

magento/magento2 · GHSA-85jx-x9r4-45m2

low2025-06-26

CVE-2025-4656-Vault Community Edition rekey and recovery key operations can cause denial of service

hashicorp/vault · GHSA-fhc2-8qx8-6vj7

critical2025-06-26

CVE-2025-50213-Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

apache/airflow · GHSA-9r64-3wmc-x8m8

medium2025-06-26

CVE-2025-52894-OpenBao allows cancellation of root rekey and recovery rekey operations without authentication

openbao/openbao · GHSA-prpj-rchp-9j5h

medium2025-06-26

CVE-2025-52573-iOS Simulator MCP Command Injection allowed via exec API

joshuayoes/ios-simulator-mcp · GHSA-6f6r-m9pv-67jw

high2025-06-26

CVE-2025-52890-Incus creates nftables rules that partially bypass security options

lxc/incus · GHSA-p7fw-vjjm-2rwp

low2025-06-26

CVE-2025-52889-Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks

lxc/incus · GHSA-9q7c-qmhm-jv86

high2025-06-26

CVE-2025-52477-Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens

octo-sts/app · GHSA-h3qp-hwvr-9xcq

low2025-06-26

CVE-2025-6701-XXL SSO is vulnerable to an Open Redirect through malicious manipulation of the redirect_url argument

xuxueli/xxl-sso · GHSA-r26v-98qj-48q9

low2025-06-26

CVE-2025-6700-Xuxueli XXL-SSO Cross-site Scripting vulnerability

xuxueli/xxl-sso · GHSA-2jfg-73q2-24qv

medium2025-06-26

CVE-2025-47943-Gogs XSS allowed by stored call in PDF renderer

gogs/gogs · GHSA-xh32-cx6c-cp4v