Security advisories

medium2025-06-04

CVE-2025-48935-Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

denoland/deno · GHSA-8vxj-4cph-c596

medium2025-06-04

CVE-2025-48934-Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

denoland/deno · GHSA-7w8p-chxq-2789

medium2025-06-04

CVE-2025-48888-Deno run with --allow-read and --deny-read flags results in allowed

denoland/deno · GHSA-xqxc-x6p3-w683

medium2025-06-04

CVE-2025-30360-webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

webpack/webpack-dev-server · GHSA-9jgg-88mc-972h

medium2025-06-04

CVE-2025-30359-webpack-dev-server users' source code may be stolen when they access a malicious web site

webpack/webpack-dev-server · GHSA-4v9v-hfq4-rm2v

high2025-06-04

CVE-2025-30167-Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

jupyter/jupyter_core · GHSA-33p9-3p43-82vq

high2025-06-04

CVE-2025-24015-Deno's AES GCM authentication tags are not verified

denoland/deno · GHSA-2x3r-hwv5-p32x

critical2025-06-04

CVE-2025-48951-Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

auth0/auth0-php · GHSA-v9m8-9xxp-q492

medium2025-06-04

CVE-2025-2336-AngularJS Incomplete Filtering of Special Elements vulnerability

angular/angular.js · GHSA-4p4w-6hg8-63wx

medium2025-06-04

CVE-2025-48710-kro Confused Deputy vulnerability

kro-run/kro · GHSA-7633-x85h-5mqh

critical2025-06-04

CVE-2025-49223-billboard.js allows prototype pollution via the function generate

naver/billboard.js · GHSA-65p9-j6pg-72hj

medium2025-06-03

CVE-2025-35036-Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language

hibernate/hibernate-validator · GHSA-7v6m-28jr-rg84

medium2025-06-03

CVE-2025-45855-Erupt Unrestricted Upload of File with Dangerous Type vulnerability

erupts/erupt · GHSA-5gr5-vmmr-82g6

medium2025-06-03

CVE-2025-48494-Gokapi vulnerable to stored XSS via uploading file with malicious file name

forceu/gokapi · GHSA-95rc-wc32-gm53

medium2025-06-03

CVE-2025-48495-Gokapi has stored XSS vulnerability in friendly name for API keys

forceu/gokapi · GHSA-4xg4-54hm-9j77

high2025-06-03

CVE-2025-48387-tar-fs can extract outside the specified dir with a specific tarball

mafintosh/tar-fs · GHSA-8cj5-5rvv-wf4v

high2025-06-03

CVE-2025-29785-quic-go Has Panic in Path Probe Loss Recovery Handling

quic-go/quic-go · GHSA-j972-j939-p2v3

medium2025-06-02

CVE-2024-8008-WSO2 products vulnerable to Cross-site Scripting

wso2/carbon-identity-framework · GHSA-xpxp-r8hf-wgf6

medium2025-06-02

CVE-2024-1440-WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint

wso2/carbon-identity-framework · GHSA-cp5v-2hmc-3vjx

medium2025-06-02

CVE-2025-3454-Grafana's datasource proxy API allows authorization checks to be bypassed

grafana/grafana · GHSA-9j65-rv5x-4vrf