Security advisories

medium2025-04-15

vLLM vulnerable to Denial of Service by abusing xgrammar cache

vllm-project/vllm · GHSA-hf3c-wxg2-49q9

high2025-04-15

Kyverno vulnerable to SSRF via Service Calls

kyverno/kyverno · GHSA-459x-q9hg-4gpq

low2025-04-15

aws-cdk-lib's aspect order change causes different Permissions Boundary assigned to Role

aws/aws-cdk · GHSA-qc59-cxj2-c2w4

low2025-04-15

CVE-2025-32021-VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext

weblateorg/weblate · GHSA-m67m-3p5g-cw9j

critical2025-04-15

CVE-2025-30206-Dpanel's hard-coded JWT secret leads to remote code execution

donknap/dpanel · GHSA-j752-cjcj-w847

medium2025-04-15

CVE-2025-3573-jquery-validation vulnerable to Cross-site Scripting

jquery-validation/jquery-validation · GHSA-rrj2-ph5q-jxw2

medium2025-04-15

CVE-2025-32997-http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

chimurai/http-proxy-middleware · GHSA-9gqv-wp59-fq42

medium2025-04-15

CVE-2025-32996-http-proxy-middleware can call writeBody twice because "else if" is not used

chimurai/http-proxy-middleware · GHSA-4www-5p9h-95mh

medium2025-04-14

CVE-2025-32782-ash_authentication has email link auto-click account confirmation vulnerability

team-alembic/ash_authentication · GHSA-3988-q8q7-p787

medium2025-04-14

CVE-2025-3588-jsonschema2pojo has Improper Restriction of Operations within the Bounds of a Memory Buffer

joelittlejohn/jsonschema2pojo · GHSA-66rc-vg9f-48m7

medium2025-04-14

CVE-2025-32388-@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params

sveltejs/kit · GHSA-6q87-84jw-cjhp

critical2025-04-14

CVE-2025-32931-DevDojo Voyager Argument Injection vulnerability

thedevdojo/voyager · GHSA-qq2h-m2hj-hrff

medium2025-04-14

CVE-2025-32439-Pleezer resource exhaustion through uncollected hook script processes

roderickvd/pleezer · GHSA-472w-7w45-g3w5

critical2025-04-14

CVE-2025-32445-Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR

argoproj/argo-events · GHSA-hmp7-x699-cvhq

low2025-04-14

CVE-2025-2424-Mattermost Incorrect Authorization vulnerability

mattermost/mattermost · GHSA-wwhj-pw6h-f8hw

medium2025-04-14

CVE-2025-2475-Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm

mattermost/mattermost · GHSA-6rqh-8465-2xcw

medium2025-04-14

CVE-2025-24358-gorilla/csrf CSRF vulnerability due to broken Referer validation

gorilla/csrf · GHSA-rq77-p4h8-4crw

medium2025-04-14

CVE-2024-47822-Directus inserts access token from query string into logs

directus/directus · GHSA-vw58-ph65-6rxp

medium2025-04-14

CVE-2025-32093-Mattermost Fails to Restrict Certain Operations on System Admins

mattermost/mattermost · GHSA-322v-vh2g-qvpv

high2025-04-14

CVE-2025-3445-mholt/archiver Vulnerable to Path Traversal via Crafted ZIP File

mholt/archiver · GHSA-7vpp-9cxj-q8gv