Security advisories

critical2025-05-21

CVE-2025-41232-Spring Security authorization bypass for method security annotations on private methods

spring-projects/spring-security · GHSA-9pp5-9c7g-4r83

high2025-05-20

CVE-2025-47941-The TYPO3 CMS Backend has Broken Authentication in Backend MFA

typo3-cms/backend · GHSA-744g-7qm9-hjh9

high2025-05-20

CVE-2025-47940-TYPO3 Allows Privilege Escalation to System Maintainer

typo3-cms/core · GHSA-6frx-j292-c844

medium2025-05-20

CVE-2025-47939-TYPO3 Allows Unrestricted File Upload in File Abstraction Layer

typo3-cms/core · GHSA-9hq9-cr36-4wpj

low2025-05-20

CVE-2025-47937-TYPO3 Allows Information Disclosure via DBAL Restriction Handling

typo3-cms/core · GHSA-x8pv-fgxp-8v3x

low2025-05-20

CVE-2025-47936-TYPO3 CMS Webhooks Server Side Request Forgery

typo3-cms/webhooks · GHSA-p4xx-m758-3hpx

critical2025-05-20

CVE-2025-47277-vLLM Allows Remote Code Execution via PyNcclPipe Communication Service

vllm-project/vllm · GHSA-hjq4-87xh-g4fv

high2025-05-20

CVE-2025-46725-Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store

langroid/langroid · GHSA-22c2-9gwg-mj59

critical2025-05-20

CVE-2025-46724-Langroid has a Code Injection vulnerability in TableChatAgent

langroid/langroid · GHSA-jqq5-wc57-f8hj

critical2025-05-19

CVE-2025-47949-samlify SAML Signature Wrapping attack

tngan/samlify · GHSA-r683-v43c-6xqv

medium2025-05-19

CVE-2025-47946-Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes

symfony/ux · GHSA-5j3w-5pcr-f8hg

high2025-05-19

CVE-2025-47944-Multer vulnerable to Denial of Service from maliciously crafted requests

expressjs/multer · GHSA-4pg4-qvpc-4q3h

high2025-05-19

CVE-2025-47935-Multer vulnerable to Denial of Service via memory leaks from unclosed streams

expressjs/multer · GHSA-44fp-w29j-9vj5

high2025-05-19

CVE-2025-47934-OpenPGP.js's message signature verification can be spoofed

openpgpjs/openpgpjs · GHSA-8qff-qr5q-5pr8

critical2025-05-19

CVE-2025-47284-Gardener allows metadata injection for a project secret which can lead to privilege escalation

gardener/gardener · GHSA-9x73-87fh-54w9

critical2025-05-19

CVE-2025-47283-Gardener allows bypassing project secret validation which can lead to privilege escalation

gardener/gardener · GHSA-3hw7-qj9h-r835

critical2025-05-19

CVE-2025-47282-Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation

gardener/external-dns-management · GHSA-xwgg-m7fx-83wx

high2025-05-19

CVE-2025-47273-setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

pypa/setuptools · GHSA-5rjg-fvgr-3xxf

medium2025-05-19

CVE-2025-47948-Cocotais Bot has builtin .echo command injection

cocotais/cocotais-bot · GHSA-mj2c-8hxf-ffvq

low2025-05-19

CVE-2025-47931-LibreNMS stored Cross-site Scripting vulnerability in poller group name

librenms/librenms · GHSA-hxw5-9cc5-cmw5