Security advisories

high2025-05-08

CVE-2025-1948-Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit

jetty/jetty.project · GHSA-889j-63jv-qhr8

high2025-05-08

CVE-2024-13009-**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request

jetty/jetty.project · GHSA-q4rv-gq96-w7c5

low2025-05-08

CVE-2025-44021-OpenStack Ironic fails to restrict paths used for file:// image URLs

openstack/ironic · GHSA-q3m2-crgq-5p3q

low2025-05-08

CVE-2025-46812-Trix vulnerable to Cross-site Scripting on copy & paste

basecamp/trix · GHSA-mcrw-746g-9q8h

high2025-05-08

CVE-2025-46727-Rack has an Unbounded-Parameter DoS in Rack::QueryParser

rack/rack · GHSA-gjh7-p2fx-99vx

medium2025-05-08

CVE-2025-46336-Rack session gets restored after deletion

rack/rack-session · GHSA-9j94-67jr-4cqj

medium2025-05-08

CVE-2025-32441-Rack session gets restored after deletion

rack/rack · GHSA-vpfw-47h7-xj4g

medium2025-05-08

CVE-2025-32873-Django has a denial-of-service possibility in strip_tags()

django/django · GHSA-8j24-cjrq-gr2m

medium2025-05-08

CVE-2025-35939-Craft CMS stores arbitrary content provided by unauthenticated users in session files

craftcms/cms · GHSA-7vrx-9684-xrf2

medium2025-05-07

CVE-2025-29746-Koillection Cross Site Scripting vulnerability

benjaminjonard/koillection · GHSA-fxvx-gfmr-5xfj

medium2025-05-07

CVE-2025-46551-JRuby-OpenSSL has hostname verification disabled by default

jruby/jruby-openssl · GHSA-72qj-48g4-5xgx

medium2025-05-07

CVE-2025-29448-Easy!Appointments Denial of Service (DoS)

alextselegidis/easyappointments · GHSA-hcjv-982c-5f29

high2025-05-07

CVE-2025-46827-Graylog Allows Session Takeover via Insufficient HTML Sanitization

graylog2/graylog2-server · GHSA-76vf-mpmx-777j

high2025-05-07

Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser

graylog2/graylog2-server · GHSA-q9q2-3ppx-mwqf

low2025-05-07

scanner has a Public API without sufficient bounds checking

pombredanne/scanner-rs · GHSA-79m9-55jc-p6mw

medium2025-05-07

Mithril snapshots for Cardano database could be compromised by an adversary

input-output-hk/mithril · GHSA-qv97-5qr8-2266

medium2025-05-07

CVE-2025-27533-Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

apache/activemq · GHSA-whxr-3p84-rf3c

high2025-05-06

CVE-2025-46573-Passport-wsfed-saml2 allows SAML Authentication Bypass via Attribute Smuggling

auth0/passport-wsfed-saml2 · GHSA-8gqj-226h-gm8r

critical2025-05-06

CVE-2025-46572-Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping

auth0/passport-wsfed-saml2 · GHSA-wjmp-wphq-jvqf

medium2025-05-06

CVE-2025-2901-HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store

hal/console · GHSA-f7jh-m6wp-jm7f