Security advisories

medium2025-04-22

CVE-2025-32955-Harden-Runner allows evasion of 'disable-sudo' policy

step-security/harden-runner · GHSA-mxr3-8whj-j74r

medium2025-04-21

CVE-2025-32963-Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

minio/operator · GHSA-7m6v-q233-q9j9

low2025-04-21

Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415

sparklemotion/nokogiri · GHSA-5w6v-399v-w3cc

high2025-04-21

CVE-2025-3857-Infinite loop condition in Amazon.IonDotnet

amazon-ion/ion-dotnet · GHSA-gm2p-wf5c-w3pj

medium2025-04-21

CVE-2025-32793-In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters

cilium/cilium · GHSA-5vxx-c285-pcq4

high2025-04-21

CVE-2025-32431-Traefik has a possible vulnerability with its path matchers

traefik/traefik · GHSA-6p68-w45g-48j7

low2025-04-21

CVE-2024-42699-OpenCMS Cross-Site Scripting vulnerability

alkacon/opencms-core · GHSA-h75c-f2xx-9vxv

critical2025-04-21

CVE-2025-29287-MCMS allows arbitrary file uploads in the ueditor component

ming-soft/mcms · GHSA-3922-2r6r-r4fv

medium2025-04-21

CVE-2024-41446-OpenCMS cross-site scripting (XSS) vulnerability

alkacon/opencms-core · GHSA-7m3w-m5g3-cc88

medium2025-04-21

CVE-2024-29643-croogo Host header injection

croogo/croogo · GHSA-847x-x4jg-6gf4

medium2025-04-21

CVE-2025-43972-GoBGP crashes in the flowspec parser

osrg/gobgp · GHSA-mfvv-mgf6-q25r

medium2025-04-21

CVE-2025-43973-GoBGP does not verify that the input length

osrg/gobgp · GHSA-c5jg-wr5v-2wp2

medium2025-04-21

CVE-2025-43970-GoBGP does not properly check the input length

osrg/gobgp · GHSA-hqhq-hp5x-xp3w

high2025-04-21

CVE-2025-43971-GoBGP panics due to a zero value for softwareVersionLen

osrg/gobgp · GHSA-7m35-vw2c-696v

medium2025-04-20

CVE-2025-43954-QMarkdown Cross-Site Scripting (XSS) vulnerability

quasarframework/quasar-ui-qmarkdown · GHSA-wm65-ph3w-587c

medium2025-04-19

CVE-2025-3801-one-api Cross-site Scripting vulnerability

songquanpeng/one-api · GHSA-wvcx-j62q-45qw

medium2025-04-18

CVE-2025-28197-Crawl4AI SSRF vulnerability

unclecode/crawl4ai · GHSA-445m-27cf-gr3x

high2025-04-18

youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

dirkf/youtube-dl · GHSA-22fp-mf44-f2mq

critical2025-04-18

Traefik affected by Go HTTP Request Smuggling Vulnerability

traefik/traefik · GHSA-5423-jcjm-2gpv

high2025-04-18

Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness of Input vulnerability

traefik/traefik · GHSA-3wqc-mwfx-672p