Security advisories

medium2025-04-28

CVE-2025-31650-Apache Tomcat Denial of Service via invalid HTTP priority header

apache/tomcat · GHSA-3p2h-wqq4-wf4h

medium2025-04-28

CVE-2025-46343-n8n Vulnerable to Stored XSS through Attachments View Endpoint

n8n-io/n8n · GHSA-c8hm-hr8h-5xjw

low2025-04-28

CVE-2025-46328-NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file

snowflakedb/snowflake-connector-nodejs · GHSA-wmjq-jrm2-9wfr

low2025-04-28

CVE-2025-46327-Go Snowflake Driver has race condition when checking access to Easy Logging configuration file

snowflakedb/gosnowflake · GHSA-6jgm-j7h2-2fqg

low2025-04-28

CVE-2025-46326-Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration file

snowflakedb/snowflake-connector-net · GHSA-c82r-c9f7-f5mj

medium2025-04-28

CVE-2025-43857-net-imap rubygem vulnerable to possible DoS by memory exhaustion

ruby/net-imap · GHSA-j3g3-5qv5-52mj

high2025-04-28

CVE-2025-22235-Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

spring-projects/spring-boot · GHSA-rc42-6c7j-7h5r

medium2025-04-27

CVE-2025-3986-Apereo CAS has inefficient regular expression complexity

apereo/cas · GHSA-mvwq-hcrj-f5x9

medium2025-04-27

CVE-2025-3985-Apereo CAS has inefficient regular expression complexity

apereo/cas · GHSA-8rx4-fxq5-vj4v

low2025-04-27

CVE-2025-3984-Apereo CAS code injection vulnerability

apereo/cas · GHSA-37pq-893f-g7q5

low2025-04-27

CVE-2025-46656-markdownify allows large headline prefixes such as <h9999999>, which causes memory consumption

matthewwithanm/python-markdownify · GHSA-7mpr-5m44-h73r

low2025-04-26

CVE-2025-46653-Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content

node-formidable/formidable · GHSA-75v8-2h7p-7m2m

medium2025-04-25

CVE-2025-3647-Moodle allows IDOR when accessing the cohorts report

moodle/moodle · GHSA-34g7-pg9j-pxgp

medium2025-04-25

CVE-2025-3645-Moodle has an IDOR in messaging web service which allows access to some user details

moodle/moodle · GHSA-pj96-xh2w-fgqx

low2025-04-25

CVE-2025-3638-Moodle has a CSRF risk in Brickfield tool's analysis request action

moodle/moodle · GHSA-m8qh-hx4c-h9hr

high2025-04-25

CVE-2025-3642-Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository

moodle/moodle · GHSA-m367-445c-2xqr

medium2025-04-25

CVE-2025-3643-Moodle has reflected Cross-site Scripting risk in policy tool

moodle/moodle · GHSA-hxgg-4qww-85ph

medium2025-04-25

CVE-2025-3644-Moodle's AJAX section delete does not respect course_can_delete_section()

moodle/moodle · GHSA-cpm7-mv33-jwf8

medium2025-04-25

CVE-2025-3636-Moodle allows IDOR in RSS block, which allows access to additional RSS feeds

moodle/moodle · GHSA-chmf-m33p-ph8m

high2025-04-25

CVE-2025-3641-Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository

moodle/moodle · GHSA-c8v6-vxhf-wcrr