Security advisories

critical2025-06-02

CVE-2025-1750-LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id

run-llama/llama_index · GHSA-6mcc-q3mg-3qg6

high2025-06-02

CVE-2025-3260-Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

grafana/grafana · GHSA-3px7-c4j3-576r

critical2025-06-02

CVE-2025-49113-Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

roundcube/roundcubemail · GHSA-8j8w-wwqc-x596

medium2025-06-02

CVE-2025-5420-juzaweb CMS allows cross-site scripting by uploading an SVG file

juzaweb/cms · GHSA-49rr-34j5-r8mw

medium2025-05-31

CVE-2018-25111-django-helpdesk Allows Sensitive Data Exposure

django-helpdesk/django-helpdesk · GHSA-m4jx-m5hg-qrxx

high2025-05-30

Arrow2 allows out of bounds access in public safe API

jorgecarleitao/arrow2 · GHSA-wv8j-m3hx-924j

medium2025-05-30

CVE-2025-48955-Para Server Logs Sensitive Information

erudika/para · GHSA-v75g-77vf-6jjq

medium2025-05-30

CVE-2025-48938-Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

cli/go-gh · GHSA-g9f5-x53j-h563

medium2025-05-30

CVE-2025-3230-Mattermost fails to properly invalidate personal access tokens upon user deactivation

mattermost/mattermost · GHSA-mc2f-jgj6-6cp3

low2025-05-30

CVE-2025-1792-Mattermost fails to properly enforce access controls for guest users

mattermost/mattermost · GHSA-hc6v-386m-93pq

medium2025-05-30

CVE-2025-2571-Mattermost fails to clear Google OAuth credentials

mattermost/mattermost · GHSA-8cgx-9ccj-3gwr

low2025-05-30

CVE-2025-3611-Mattermost fails to properly enforce access control restrictions for System Manager roles

mattermost/mattermost · GHSA-86jg-35xj-3vv5

high2025-05-30

CVE-2025-48912-Apache Superset: Improper authorization bypass on row level security via SQL Injection

apache/superset · GHSA-8w7f-8pr9-xgwj

high2025-05-30

CVE-2025-41235-Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

spring-cloud/spring-cloud-gateway · GHSA-6j2q-c73v-97c5

medium2025-05-29

CVE-2025-48889-Gradio Allows Unauthorized File Copy via Path Manipulation

gradio-app/gradio · GHSA-8jw3-6x8j-v96g

high2025-05-29

CVE-2025-48948-Navidrome Transcoding Permission Bypass Vulnerability Report

navidrome/navidrome · GHSA-f238-rggp-82m3

low2025-05-29

CVE-2025-46701-Apache Tomcat - CGI security constraint bypass

apache/tomcat · GHSA-h2fw-rfh5-95r3

medium2025-05-29

CVE-2025-3913-Mattermost improperly allows team administrators to modify team invites

mattermost/mattermost · GHSA-4mmr-2w8p-whcr

high2025-05-29

CVE-2025-48949-Navidrome allows SQL Injection via role parameter

navidrome/navidrome · GHSA-5wgp-vjxm-3x2r

high2025-05-29

CVE-2025-48882-PHPOffice Math allows XXE when processing an XML file in the MathML format

phpoffice/math · GHSA-42hm-pq2f-3r7m