Security advisories

critical2025-05-14

CVE-2024-24780-Apache IoTDB Vulnerable to Remote Code Execution

apache/iotdb · GHSA-f4rq-f4j9-f6rm

medium2025-05-14

CVE-2025-26864-Apache IoTDB Discloses Sensitive Information via Log Files

apache/iotdb · GHSA-5fc3-pqf2-57cx

high2025-05-13

CVE-2025-26646-Microsoft.Build.Tasks.Core .NET Spoofing Vulnerability

dotnet/msbuild · GHSA-h4j7-5rxr-p4wc

critical2025-05-13

CVE-2025-4658-OPKSSH Vulnerable to Authentication Bypass

openpubkey/opkssh · GHSA-56wx-66px-9j66

critical2025-05-13

CVE-2025-3757-OpenPubkey Vulnerable to Authentication Bypass

openpubkey/openpubkey · GHSA-537f-gxgm-3jjq

low2025-05-13

CVE-2025-47278-Flask uses fallback key instead of current signing key

pallets/flask · GHSA-4grg-w6v8-c28g

low2025-05-13

CVE-2025-47280-Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow

umbraco/umbraco.forms.issues · GHSA-2qrj-g9hq-chph

low2025-05-13

CVE-2025-46718-sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others

trifectatechfoundation/sudo-rs · GHSA-w9q3-g4p5-5q2r

medium2025-05-13

CVE-2025-30159-Kirby vulnerable to path traversal of snippet names in the `snippet()` helper

getkirby/kirby · GHSA-fw82-87p8-v6hp

low2025-05-13

CVE-2025-30207-Kirby vulnerable to path traversal in the router for PHP's built-in server

getkirby/kirby · GHSA-9p3p-w5jf-8xxg

medium2025-05-13

CVE-2025-31493-Kirby vulnerable to path traversal of collection names during file system lookup

getkirby/kirby · GHSA-x275-h9j4-7p4h

medium2025-05-13

CVE-2025-47204-Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data

davidstutz/bootstrap-multiselect · GHSA-gv5r-9gxr-v74w

high2025-05-13

CVE-2024-56526-OXID eShop May Display User Information

oxid-esales/oxideshop_ce · GHSA-qqcr-9jfc-35c4

low2025-05-13

CVE-2025-46717-sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders

trifectatechfoundation/sudo-rs · GHSA-98cv-wqjx-wx8f

medium2025-05-13

CVE-2025-27696-Apache Superset Allows Ownership Takeover

apache/superset · GHSA-w6c7-j32f-rq8j

medium2025-05-12

CVE-2025-47271-OZI-Project/ozi-publish Code Injection vulnerability

ozi-project/publish · GHSA-2487-9f55-2vg9

medium2025-05-11

CVE-2025-47828-@lumieducation/h5p-server Fails to Sanitize Plain Text Strings

lumieducation/h5p-nodejs-library · GHSA-m7gm-v253-56hh

high2025-05-10

CVE-2025-1752-LlamaIndex Vulnerable to Denial of Service (DoS)

run-llama/llama_index · GHSA-7c85-87cp-mr6g

high2025-05-09

CVE-2025-47269-code-server's session cookie can be extracted by having user visit specially crafted proxy URL

coder/code-server · GHSA-p483-wpfp-42cj

low2025-05-09

CVE-2025-46392-Apache Commons Configuration Uncontrolled Resource Consumption

apache/commons-configuration · GHSA-pvp8-3xj6-8c6x