Security advisories

high2025-06-25

CVE-2025-6032-Podman Improper Certificate Validation; machine missing TLS verification

containers/podman · GHSA-65gg-3w2w-hr4h

low2025-06-25

CVE-2025-52884-RISC Zero Ethereum invalid commitment with digest value of zero accepted by Steel.validateCommitment

risc0/risc0-ethereum · GHSA-gjv3-89hh-9xq2

high2025-06-25

CVE-2025-52888-Allure Report allows Improper XXE Restriction via DocumentBuilderFactory

allure-framework/allure2 · GHSA-h7qf-qmf3-85qg

medium2025-06-24

CVE-2025-53021-Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter

moodle/moodle · GHSA-cgvv-3455-824j

medium2025-06-24

CVE-2025-49147-Umbraco CMS disclosure of configured password requirements

umbraco/umbraco-cms · GHSA-pgvc-6h2p-q4f6

critical2025-06-24

CVE-2024-56731-Gogs allows deletion of internal files which leads to remote command execution

gogs/gogs · GHSA-wj44-9vcg-wjq7

critical2025-06-23

CVE-2025-6547-pbkdf2 silently disregards Uint8Array input, returning static keys

browserify/pbkdf2 · GHSA-v62p-rq8g-8h59

critical2025-06-23

CVE-2025-6545-pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos

browserify/pbkdf2 · GHSA-h7cp-r72f-jxh6

high2025-06-23

CVE-2025-2828-LangChain Community SSRF vulnerability exists in RequestsToolkit component

langchain-ai/langchain-community · GHSA-h5gc-rm8j-5gpr

low2025-06-23

CVE-2025-6518-pyspur Incomplete Filtering of Special Elements allowed by SingleLLMCallNode function

pyspur-dev/pyspur · GHSA-8gff-cf92-72pv

medium2025-06-23

CVE-2025-52570-letmein connection limiter allows an arbitrary amount of simultaneous connections

mbuesch/letmein · GHSA-jpv7-p47h-f43j

high2025-06-23

CVE-2025-52882-Claude Code Improper Authorization via websocket connections from arbitrary origins

anthropics/claude-code · GHSA-9f65-56v6-gxw7

high2025-06-23

CVE-2025-52558-ChangeDetection.io XSS in watch overview

dgtlmoon/changedetection.io · GHSA-hwpg-x5hw-vpv9

medium2025-06-23

CVE-2025-49574-Quarkus potentially leaks data when duplicating a duplicated context

quarkusio/quarkus · GHSA-9623-mj7j-p9v4

low2025-06-23

CVE-2025-4563-kubernetes allows nodes to bypass dynamic resource allocation authorization checks

kubernetes/kubernetes · GHSA-hj2p-8wj8-pfq4

medium2025-06-23

CVE-2025-52967-MLFlow SSRF via gateway_proxy_handler

mlflow/mlflow · GHSA-wxj7-3fx5-pp9m

low2025-06-23

CVE-2025-52926-spytrap-adb Omission of Security-relevant Information

spytrap-org/spytrap-adb · GHSA-5p2p-6g2c-hf7m

critical2025-06-20

CVE-2025-52556-rfc3161-client has insufficient verification for timestamp response signatures

trailofbits/rfc3161-client · GHSA-6qhv-4h7r-2g9m

low2025-06-20

CVE-2025-52484-zkVM Underconstrained Vulnerability

risc0/risc0 · GHSA-g3qg-6746-3mg9

high2025-06-20

CVE-2025-4366-Pingora has a Request Smuggling Vulnerability

cloudflare/pingora · GHSA-93c7-7xqw-w357