Security advisories

medium2025-05-13

CVE-2025-31493-Kirby vulnerable to path traversal of collection names during file system lookup

getkirby/kirby · GHSA-x275-h9j4-7p4h

medium2025-05-13

CVE-2025-47204-Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data

davidstutz/bootstrap-multiselect · GHSA-gv5r-9gxr-v74w

high2025-05-13

CVE-2024-56526-OXID eShop May Display User Information

oxid-esales/oxideshop_ce · GHSA-qqcr-9jfc-35c4

low2025-05-13

CVE-2025-46717-sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders

trifectatechfoundation/sudo-rs · GHSA-98cv-wqjx-wx8f

medium2025-05-13

CVE-2025-27696-Apache Superset Allows Ownership Takeover

apache/superset · GHSA-w6c7-j32f-rq8j

medium2025-05-12

CVE-2025-47271-OZI-Project/ozi-publish Code Injection vulnerability

ozi-project/publish · GHSA-2487-9f55-2vg9

medium2025-05-11

CVE-2025-47828-@lumieducation/h5p-server Fails to Sanitize Plain Text Strings

lumieducation/h5p-nodejs-library · GHSA-m7gm-v253-56hh

high2025-05-10

CVE-2025-1752-LlamaIndex Vulnerable to Denial of Service (DoS)

run-llama/llama_index · GHSA-7c85-87cp-mr6g

high2025-05-09

CVE-2025-47269-code-server's session cookie can be extracted by having user visit specially crafted proxy URL

coder/code-server · GHSA-p483-wpfp-42cj

low2025-05-09

CVE-2025-46392-Apache Commons Configuration Uncontrolled Resource Consumption

apache/commons-configuration · GHSA-pvp8-3xj6-8c6x

low2025-05-09

CVE-2025-47737-trailer mishandles allocating with a size of zero

geal/trailer · GHSA-6x45-r4pr-5362

low2025-05-09

CVE-2025-47735-wgp race condition in inner::drop

nugine/wgp · GHSA-2w4w-4385-vh4h

high2025-05-08

CVE-2025-1948-Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit

jetty/jetty.project · GHSA-889j-63jv-qhr8

high2025-05-08

CVE-2024-13009-**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request

jetty/jetty.project · GHSA-q4rv-gq96-w7c5

low2025-05-08

CVE-2025-44021-OpenStack Ironic fails to restrict paths used for file:// image URLs

openstack/ironic · GHSA-q3m2-crgq-5p3q

low2025-05-08

CVE-2025-46812-Trix vulnerable to Cross-site Scripting on copy & paste

basecamp/trix · GHSA-mcrw-746g-9q8h

high2025-05-08

CVE-2025-46727-Rack has an Unbounded-Parameter DoS in Rack::QueryParser

rack/rack · GHSA-gjh7-p2fx-99vx

medium2025-05-08

CVE-2025-46336-Rack session gets restored after deletion

rack/rack-session · GHSA-9j94-67jr-4cqj

medium2025-05-08

CVE-2025-32441-Rack session gets restored after deletion

rack/rack · GHSA-vpfw-47h7-xj4g

medium2025-05-08

CVE-2025-32873-Django has a denial-of-service possibility in strip_tags()

django/django · GHSA-8j24-cjrq-gr2m