Security advisories

medium2025-04-24

CVE-2025-35965-Mattermost Playbooks fails to validate the uniqueness and quantity of task actions

mattermost/mattermost-plugin-playbooks · GHSA-689c-xq7x-xjwf

medium2025-04-24

CVE-2025-41395-Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type

mattermost/mattermost-plugin-playbooks · GHSA-3g36-gf7c-75qw

critical2025-04-23

CVE-2025-43858-YoutubeDLSharp allows command injection on windows system due to non sanitized arguments

bluegrams/youtubedlsharp · GHSA-2jh5-g5ch-43q5

medium2025-04-23

CVE-2025-46567-LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py

hiyouga/llama-factory · GHSA-f2f7-gj54-6vpv

high2025-04-23

CVE-2025-1520-PostHog Plugin Server SQL Injection Vulnerability

posthog/plugin-server · GHSA-v64v-fq96-c5wv

medium2025-04-23

CVE-2026-26994-uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries

refraction-networking/utls · GHSA-pmc3-p9hx-jq96

critical2025-04-23

CVE-2025-32969-org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

xwiki/xwiki-platform · GHSA-f69v-xrj8-rhxf

high2025-04-23

CVE-2025-32968-org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API

xwiki/xwiki-platform · GHSA-g9jj-75mx-wjcx

medium2025-04-23

CVE-2024-47829-pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

pnpm/pnpm · GHSA-8cc4-rfj6-fhg4

critical2025-04-23

CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0

vllm-project/vllm · GHSA-ggpf-24jw-3fcw

medium2025-04-22

CVE-2025-26159-Laravel Starter Cross Site Scripting (XSS)

nasirkhan/laravel-starter · GHSA-fpx3-h2pc-88vf

critical2025-04-22

CVE-2025-32965-Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

xrplf/xrpl.js · GHSA-33qr-m49q-rxfx

medium2025-04-22

CVE-2025-32961-XSS in the /download Endpoint of the JPA Web API

cuba-platform/jpawebapi · GHSA-hg25-w3vg-7279

medium2025-04-22

CVE-2025-32960-XSS in the /files Endpoint of the Generic REST API

cuba-platform/restapi · GHSA-88h5-34xw-2q56

medium2025-04-22

CVE-2025-32959-Cuba has a DoS in the File Storage

cuba-platform/cuba · GHSA-w3mp-6vrj-875g

medium2025-04-22

CVE-2025-32952-io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage

jmix-framework/jmix · GHSA-f3gv-cwwh-758m

medium2025-04-22

CVE-2025-32951-io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API

jmix-framework/jmix · GHSA-x27v-f838-jh93

critical2025-04-22

CVE-2025-24016-Wazuh server vulnerable to remote code execution

wazuh/wazuh · GHSA-hcrc-79hj-m3qh

medium2025-04-22

CVE-2025-32950-io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage

jmix-framework/jmix · GHSA-jx4g-3xqm-62vh

medium2025-04-22

CVE-2025-32788-OctoPrint Authenticated Reverse Proxy Page Authentication Bypass

octoprint/octoprint · GHSA-qw93-h6pf-226x