Security advisories

medium2025-05-02

CVE-2025-46332-Information Disclosure via Flags override link

vercel/flags · GHSA-892p-pqrr-hxqr

medium2025-05-02

CVE-2025-3879-Hashicorp Vault Community vulnerable to Incorrect Authorization

hashicorp/vault · GHSA-f9ch-h8j7-8jwg

medium2025-05-02

CVE-2025-4210-Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor

casdoor/casdoor · GHSA-8w8f-h4cm-c4pg

medium2025-05-02

CVE-2025-4166-Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information

hashicorp/vault · GHSA-gcqf-f89c-68hv

high2025-05-01

CVE-2025-46569-OPA server Data API HTTP path injection of Rego

open-policy-agent/opa · GHSA-6m8w-jc87-6cr7

medium2025-05-01

CVE-2025-4144-@cloudflare/workers-oauth-provider PKCE bypass via downgrade attack

cloudflare/workers-oauth-provider · GHSA-qgp8-v765-qxx9

medium2025-05-01

CVE-2025-4143-@cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint

cloudflare/workers-oauth-provider · GHSA-4pc9-x2fx-p7vj

medium2025-05-01

CVE-2024-52979-Elasticsearch Uncontrolled Resource Consumption Vulnerability

elastic/elasticsearch · GHSA-mm3m-5497-xggg

critical2025-05-01

CVE-2025-46337-SQL injection in ADOdb PostgreSQL driver pg_insert_id() method

adodb/adodb · GHSA-8x27-jwjr-8545

medium2025-04-30

Panic in mp3-metadata due to the lack of bounds checking

guillaumegomez/mp3-metadata · GHSA-927q-g9w9-pm54

medium2025-04-30

CVE-2025-46565-Vite's server.fs.deny bypassed with /. for files under project root

vitejs/vite · GHSA-859w-5945-r5v3

medium2025-04-30

CVE-2025-3910-Keycloak vulnerable to two factor authentication bypass

keycloak/keycloak · GHSA-5jfq-x6xp-7rw2

high2025-04-30

CVE-2025-3501-Keycloak hostname verification

keycloak/keycloak · GHSA-hw58-3793-42gg

critical2025-04-30

CVE-2025-46558-org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

xwiki-contrib/syntax-markdown · GHSA-8g2j-rhfh-hq3r

high2025-04-30

CVE-2025-46557-Any user with view access to the XWiki space can change the authenticator

xwiki/xwiki-platform · GHSA-f9c6-2f9p-82jj

medium2025-04-30

CVE-2025-46554-XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

xwiki/xwiki-platform · GHSA-r5cr-xm48-97xp

medium2025-04-30

CVE-2025-46331-OpenFGA Authorization Bypass

openfga/openfga · GHSA-w222-m46c-mgh6

high2025-04-30

CVE-2025-32777-Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin

volcano-sh/volcano · GHSA-hg79-fw4p-25p8

high2025-04-30

CVE-2025-27611-Homograph attack allows Unicode lookalike characters to bypass validation.

cryptocoinjs/base-x · GHSA-xq7p-g2vc-g82p

critical2025-04-29

CVE-2025-0520-ShowDoc unrestricted file upload vulnerability

star7th/showdoc · GHSA-6jmr-r7p6-f5wr