Security advisories

low2025-06-12

CVE-2025-43863-vantage6 lacks brute-force protection on change password functionality

vantage6/vantage6 · GHSA-j6g5-p62x-58hw

critical2025-06-12

CVE-2024-56158-XWiki allows SQL injection in query endpoint of REST API with Oracle

xwiki/xwiki-platform · GHSA-prwh-7838-xf82

medium2025-06-12

CVE-2024-44906-uptrace pgdriver SQL injection vulnerability

uptrace/bun · GHSA-h4h6-vccr-44h2

medium2025-06-12

CVE-2025-29744-pg-promise SQL Injection vulnerability

vitaly-t/pg-promise · GHSA-ff9h-848c-4xfj

medium2025-06-12

CVE-2024-44905-go-pg SQL injection vulnerability via the component /types/append_value.go

go-pg/pg · GHSA-6xp3-p59p-q4fj

medium2025-06-11

CVE-2025-49575-Citizen skin vulnerable to stored XSS through multiple system messages

starcitizentools/mediawiki-skins-citizen · GHSA-4c2h-67qq-vm87

high2025-06-11

CVE-2025-4922-Hashicorp Nomad Incorrect Privilege Assignment vulnerability

hashicorp/nomad · GHSA-rx97-6c62-55mf

high2025-06-11

CVE-2025-30399-Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability

dotnet/runtime · GHSA-266m-wp2v-x7mq

medium2025-06-11

Regex literal in Hurl files are not escaped when exported to HTML, allowing injections

orange-opensource/hurl · GHSA-v33j-v3x4-42qg

high2025-06-11

CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error

cosmwasm/wasmd · GHSA-79xg-q4qm-7v9w

high2025-06-11

CVE-2025-49146-pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

pgjdbc/pgjdbc · GHSA-hq9p-pm7w-8p54

low2025-06-11

CVE-2025-4128-Mattermost allows guest users to view information about public teams they are not members of

mattermost/mattermost · GHSA-jwhw-xf5v-qgxc

medium2025-06-11

CVE-2025-4573-Mattermost allows authenticated administrator to execute LDAP search filter injection

mattermost/mattermost · GHSA-4r67-4x4p-fprg

critical2025-06-10

CVE-2025-36852-@nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests

nrwl/nx · GHSA-rrr2-jcr8-7q3x

low2025-06-10

CVE-2025-8556-CIRCL-Fourq: Missing and wrong validation can lead to incorrect results

cloudflare/circl · GHSA-2x5j-vhc8-9cwm

medium2025-06-10

CVE-2025-49143-Nautobot may allows uploaded media files to be accessible without authentication

nautobot/nautobot · GHSA-rh67-4c8j-hjjh

high2025-06-10

GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx

geoserver/geoserver · GHSA-68cf-j696-wvv9

medium2025-06-10

CVE-2025-49142-Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

nautobot/nautobot · GHSA-wjw6-95h5-4jpx

medium2025-06-10

CVE-2025-48937-matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator

matrix-org/matrix-rust-sdk · GHSA-x958-rvg6-956w

medium2025-06-10

CVE-2025-48879-OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint

octoprint/octoprint · GHSA-9wj4-8h85-pgrw