Security advisories

low2025-04-25

CVE-2025-3637-Moodle's mod_data edit/delete pages pass CSRF token in GET parameter

moodle/moodle · GHSA-9vc3-vm42-fjhm

low2025-04-25

CVE-2025-3635-Moodle has a CSRF risk in user tours manager that allows tour duplication

moodle/moodle · GHSA-88xj-97gf-7wpq

medium2025-04-25

CVE-2025-3640-Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users

moodle/moodle · GHSA-6g5x-h5x7-q4mq

medium2025-04-25

CVE-2025-3627-Moodle makes some user data available before completing second factor with MFA enabled

moodle/moodle · GHSA-x45j-jq9q-gf3q

medium2025-04-25

CVE-2025-3634-Moodle self enrollment available before completing second factor with MFA enabled

moodle/moodle · GHSA-qhc7-xhc2-7p7w

medium2025-04-25

CVE-2025-32045-Moodle shows hidden grades to users without permission on some grade reports

moodle/moodle · GHSA-8m7c-hm88-2p97

medium2025-04-25

CVE-2025-3628-Moodle reveals student identities through assignment submissions search on anonymous submissions

moodle/moodle · GHSA-69m9-rprc-2x7g

high2025-04-25

CVE-2025-32044-Moodle allows unauthenticated REST API user data exposure

moodle/moodle · GHSA-345q-9jmq-g9q4

medium2025-04-25

GraphQL Armor Cost-Limit Plugin Bypass via Introspection Query Obfuscation

escape-technologies/graphql-armor · GHSA-733v-p3h5-qpq7

high2025-04-25

CVE-2023-32198-Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks

rancher/steve · GHSA-95fc-g4gj-mqmx

medium2025-04-25

CVE-2025-23390-Fleet doesn’t validate a server’s certificate when connecting through SSH

rancher/fleet · GHSA-xgpc-q899-67p8

high2025-04-25

CVE-2024-22031-Rancher users who can create Projects can gain access to arbitrary projects

rancher/rancher · GHSA-8h6m-wv39-239m

critical2025-04-25

CVE-2025-32432-Craft CMS Allows Remote Code Execution

craftcms/cms · GHSA-f3gw-9ww9-jmc3

medium2025-04-25

CVE-2025-46599-CNCF K3s Kubernetes kubelet configuration exposes credentials

k3s-io/k3s · GHSA-864f-7xjm-2jp2

high2025-04-24

CVE-2025-43865-React Router allows pre-render data spoofing on React-Router framework mode

remix-run/react-router · GHSA-cpj6-fhp6-mr6j

high2025-04-24

CVE-2025-43864-React Router allows a DoS via cache poisoning by forcing SPA mode

remix-run/react-router · GHSA-f46r-rw29-r322

critical2025-04-24

CVE-2025-43859-h11 accepts some malformed Chunked-Encoding bodies

python-hyper/h11 · GHSA-vqfr-h8mv-ghfj

high2025-04-24

CVE-2025-43855-tRPC 11 WebSocket DoS Vulnerability

trpc/trpc · GHSA-pj3v-9cm8-gvj8

high2025-04-24

CVE-2025-27820-Apache HttpClient disables domain checks

apache/httpcomponents-client · GHSA-73m2-qfq3-56cx

low2025-04-24

CVE-2025-41423-Mattermost Playbooks fails to properly validate permissions

mattermost/mattermost-plugin-playbooks · GHSA-fr22-5377-f3p7