Security advisories

high2025-06-06

CVE-2025-47950-CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification

coredns/coredns · GHSA-cvx7-x8pj-x2gw

medium2025-06-06

CVE-2025-49009-Para Inserts Sensitive Information into Log File for Facebook authentication

erudika/para · GHSA-qx7g-fx8q-545g

high2025-06-06

CVE-2025-5806-Jenkins Gatling Plugin Vulnerable to Cross-Site Scripting (XSS)

jenkinsci/gatling-plugin · GHSA-gw97-cqwg-xmh4

high2025-06-06

CVE-2025-27531-Apache InLong Deserialization of Untrusted Data Vulnerability

apache/inlong · GHSA-62gc-8jr5-x9pm

critical2025-06-06

laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

auth0/laravel-auth0 · GHSA-c42h-56wx-h85q

critical2025-06-06

Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

auth0/symfony · GHSA-98j6-67v3-mw34

medium2025-06-05

CVE-2025-48493-Yii 2 Redis may expose AUTH parameters in logs in case of connection failure

yiisoft/yii2-redis · GHSA-g3p6-82vc-43jh

critical2025-06-05

CVE-2025-1793-llama_index vulnerable to SQL Injection

run-llama/llama_index · GHSA-v3c8-3pr6-gr7p

medium2025-06-05

CVE-2025-49007-ReDoS Vulnerability in Rack::Multipart handle_mime_head

rack/rack · GHSA-47m2-26rw-j2jw

medium2025-06-05

CVE-2025-48432-Django Improper Output Neutralization for Logs vulnerability

django/django · GHSA-7xr5-9hcq-chf9

medium2025-06-05

CVE-2024-21486-Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

denoland/deno · GHSA-jv4x-jv3h-qff5

critical2025-06-05

Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

auth0/wordpress · GHSA-862m-5253-832r

high2025-06-05

CVE-2025-5791-users may append `root` to group listings

ogham/rust-users · GHSA-m65q-v92h-cm7q

high2025-06-05

CVE-2025-48997-Multer vulnerable to Denial of Service via unhandled exception

expressjs/multer · GHSA-g5hg-p3ph-g8qg

medium2025-06-05

CVE-2025-48996-Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint

haxtheweb/issues · GHSA-fvx2-x7ff-fc56

medium2025-06-05

CVE-2025-48994-SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack

xml-security/signxml · GHSA-6vx8-pcwv-xhf4

medium2025-06-05

CVE-2025-48995-SignXML's signature verification with HMAC is vulnerable to a timing attack

xml-security/signxml · GHSA-gmhf-gg8w-jw42

high2025-06-04

CVE-2025-48957-AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

astrbotdevs/astrbot · GHSA-cq37-g2qp-3c2p

medium2025-06-04

CVE-2025-48953-Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

umbraco/umbraco-cms · GHSA-fr6r-p8hv-x3c4

high2025-06-04

CVE-2025-48947-NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

auth0/nextjs-auth0 · GHSA-f3fg-mf2q-fj3f