Security advisories

medium2025-06-09

CVE-2025-5897-@vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability

vuejs/vue-cli · GHSA-79vf-hf9f-j9q8

low2025-06-09

CVE-2025-5891-pm2 Regular Expression Denial of Service vulnerability

unitech/pm2 · GHSA-x5gf-qvw8-r2rm

low2025-06-09

CVE-2025-5889-brace-expansion Regular Expression Denial of Service vulnerability

juliangruber/brace-expansion · GHSA-v6h2-p8h4-qcjw

high2025-06-09

CVE-2025-49141-HaxCMS-PHP Command Injection Vulnerability

haxtheweb/haxcms-nodejs · GHSA-g4cf-pp4x-hqgw

high2025-06-09

CVE-2025-49140-Pion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS)

pion/interceptor · GHSA-f26w-gh5m-qq77

medium2025-06-09

CVE-2025-49139-@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability

haxtheweb/issues · GHSA-v3ph-2q5q-cg88

medium2025-06-09

CVE-2024-47081-Requests vulnerable to .netrc credentials leak via malicious URLs

psf/requests · GHSA-9hjg-9r4m-mvj7

critical2025-06-09

CVE-2025-49652-BackendAI Missing Authentication for Critical Function

lablup/backend.ai · GHSA-ww28-4m4v-cq4j

high2025-06-09

CVE-2025-49653-BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

lablup/backend.ai · GHSA-hxvr-gg2w-j48x

high2025-06-09

CVE-2025-49651-Backend.AI Missing Authorization vulnerability

lablup/backend.ai · GHSA-h889-475r-wfmm

high2025-06-09

CVE-2025-45001-react-native-keys insecurely stores encryption cipher and Base64 chunks

numandev1/react-native-keys · GHSA-fj44-h6xw-896g

medium2025-06-09

CVE-2025-49138-HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter

haxtheweb/issues · GHSA-hxrr-x32w-cg8g

high2025-06-09

CVE-2025-49137-Hax CMS Stored Cross-Site Scripting vulnerability

haxtheweb/issues · GHSA-2vc4-3hx7-v7v7

medium2025-06-09

CVE-2025-49130-Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

barryvdh/laravel-translation-manager · GHSA-j226-63j7-qrqh

critical2025-06-09

CVE-2025-49136-listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

knadh/listmonk · GHSA-jc7g-x28f-3v3h

medium2025-06-09

CVE-2025-25208-Authorino Uncontrolled Resource Consumption vulnerability

kuadrant/authorino · GHSA-vqvv-2wj5-q34w

medium2025-06-09

CVE-2025-25207-Authorino Uncontrolled Resource Consumption vulnerability

kuadrant/authorino · GHSA-r8xr-pgv5-gxw3

high2025-06-07

CVE-2025-49619-Skyvern has a Jinja runtime leak

skyvern-ai/skyvern · GHSA-h92g-3xc3-ww2r

medium2025-06-07

CVE-2025-49128-Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation

fasterxml/jackson-core · GHSA-wf8f-6423-gfxg

low2025-06-06

CVE-2025-49011-SpiceDB checks involving relations with caveats can result in no permission when permission is expected

authzed/spicedb · GHSA-cwwm-hr97-qfxm