Security advisories

medium2025-05-19

CVE-2025-2099-Hugging Face Transformers Regular Expression Denial of Service

huggingface/transformers · GHSA-qq3j-4f4f-9583

critical2025-05-17

laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

auth0/laravel-auth0 · GHSA-9fwj-9mjf-rhj3

critical2025-05-17

Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

auth0/wordpress · GHSA-2f4r-34m4-3w8q

critical2025-05-17

Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

auth0/symfony · GHSA-9wg9-93h9-j8ch

low2025-05-16

CVE-2025-22233-Spring Framework DataBinder Case Sensitive Match Exception

spring-projects/spring-framework · GHSA-4wp7-92pw-q264

critical2025-05-16

CVE-2025-47275-Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK

auth0/auth0-php · GHSA-g98g-r7gf-2r25

medium2025-05-16

CVE-2025-32962-Flask-AppBuilder open redirect vulnerability using HTTP host injection

dpgaspar/flask-appbuilder · GHSA-99pm-ch96-ccp2

medium2025-05-16

CVE-2024-40120-SeaweedFS Vulnerable to SQL Injection

seaweedfs/seaweedfs · GHSA-q97m-8853-pq76

low2025-05-16

CVE-2025-47774-Vyper's `slice()` may elide side-effects when output length is 0

vyperlang/vyper · GHSA-3vcg-j39x-cwfm

high2025-05-16

CVE-2025-47287-Tornado vulnerable to excessive logging caused by malformed multipart form data

tornadoweb/tornado · GHSA-7cx3-6m66-7c5m

low2025-05-16

CVE-2025-47285-Vyper's `concat()` builtin may elide side-effects for zero-length arguments

vyperlang/vyper · GHSA-qhr6-mgqr-mchm

high2025-05-16

CVE-2025-1975-Ollama Server Vulnerable to Denial of Service (DoS) Attack

ollama/ollama · GHSA-wrh5-cmwx-q2qr

medium2025-05-16

CVE-2025-4759-lockfile-lint-api Vulnerable to Incorrect Behavior Order

lirantal/lockfile-lint · GHSA-7cfr-5cjf-32p4

medium2025-05-16

CVE-2025-4727-Meteor Affected By Inefficient Regular Expression Complexity

meteor/meteor · GHSA-j3v9-6gc7-vf5f

medium2025-05-15

CVE-2025-1647-Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

twbs/bootstrap · GHSA-q58r-hwc8-rm9j

medium2025-05-15

CVE-2025-2527-Mattermost Fails to Verify User's Permissions When Accessing Groups

mattermost/mattermost · GHSA-h356-3mfw-x368

low2025-05-15

CVE-2025-2570-Mattermost Fails to Check User Access to `ExperimentalSettings`

mattermost/mattermost · GHSA-fpff-wj6m-grvr

medium2025-05-15

CVE-2025-47775-Bullfrog's DNS over TCP bypasses domain filtering

bullfrogsec/bullfrog · GHSA-m32f-fjw2-37v3

high2025-05-15

macroquad vulnerable to multiple soundness issues

not-fl3/macroquad · GHSA-gg76-hg3v-5q6c

high2025-05-15

CVE-2025-47783-label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.

humansignal/label-studio · GHSA-8jhr-wpcm-hh4h