Security advisories

low2025-05-28

CVE-2025-48068-Information exposure in Next.js dev server due to lack of origin verification

vercel/next.js · GHSA-3h52-269p-cp9r

medium2025-05-28

multicast in source builds from vulnerable setuptools dependency

reactive-firewall/multicast · GHSA-94v7-wxj6-r2q5

medium2025-05-28

CVE-2025-48944-vLLM Tool Schema allows DoS via Malformed pattern and type Fields

vllm-project/vllm · GHSA-vrq3-r879-7m65

medium2025-05-28

CVE-2025-48943-vLLM allows clients to crash the openai server with invalid regex

vllm-project/vllm · GHSA-9hcf-v7m4-6m2j

medium2025-05-28

CVE-2025-48942-vLLM DOS: Remotely kill vllm over http with invalid JSON schema

vllm-project/vllm · GHSA-6qc9-v4r8-22xg

medium2025-05-28

CVE-2025-46722-vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

vllm-project/vllm · GHSA-c65p-x677-fgj6

low2025-05-28

CVE-2025-46570-Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

vllm-project/vllm · GHSA-4qjh-9fv9-r85r

medium2025-05-28

vLLM vulnerable to Regular Expression Denial of Service

vllm-project/vllm · GHSA-j828-28rj-hfhp

medium2025-05-28

CVE-2025-48887-vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`

vllm-project/vllm · GHSA-w6q7-j642-7c25

medium2025-05-28

CVE-2025-5256-Mautic has an Open Redirect vulnerability on user unlock path.

mautic/mautic · GHSA-6vx9-9r2g-8373

medium2025-05-28

CVE-2024-47055-Mautic segment cloning doesn't have a proper permission check

mautic/mautic · GHSA-vph5-ghq3-q782

medium2025-05-28

CVE-2024-47057-Mautic allows user name enumeration due to response time difference on password reset form

mautic/mautic · GHSA-424x-cxvh-wq9p

medium2025-05-28

CVE-2024-47056-Mautic does not shield .env files from web traffic

mautic/mautic · GHSA-h2wg-v8wg-jhxh

medium2025-05-28

CVE-2025-5257-Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure

mautic/mautic · GHSA-cqx4-9vqf-q3m8

high2025-05-28

CVE-2025-48936-ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection

zitadel/zitadel · GHSA-93m4-mfpg-c3xf

critical2025-05-28

CVE-2025-47933-Argo CD allows cross-site scripting on repositories page

argoproj/argo-cd · GHSA-2hj5-g64g-fp6p

medium2025-05-28

CVE-2025-48883-Chrome PHP is missing encoding in `CssSelector`

chrome-php/chrome · GHSA-3432-fmrf-7vmh

high2025-05-28

CVE-2025-48734-Apache Commons Improper Access Control vulnerability

apache/commons-beanutils · GHSA-wxr5-93ph-8wr9

high2025-05-28

CVE-2025-5279-Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin

aws/amazon-redshift-python-driver · GHSA-r244-wg5g-6w2r

critical2025-05-28

Cromwell GitHub Actions Secrets exfiltration via `Issue_comment`

broadinstitute/cromwell · GHSA-phf6-hm3h-x8qp