Security advisories

high2025-04-12

CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows

cefsharp/cefsharp · GHSA-f87w-3j5w-v58p

critical2025-04-12

CVE-2025-32428-TigerVNC accessible via the network and not just via a UNIX socket as intended

jupyterhub/jupyter-remote-desktop-proxy · GHSA-vrq4-9hc3-cgp7

medium2025-04-12

CVE-2025-1386-CVE-2025-1386- Query smuggling in ch-go library

clickhouse/ch-go · GHSA-m454-3xv7-qj85

high2025-04-12

CVE-2025-22869-golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange

golang/crypto · GHSA-hcg3-q754-cr77

medium2025-04-11

CVE-2025-32426-Formie has XSS vulnerability for email notification content for preview

verbb/formie · GHSA-2xm2-23ff-p8ww

medium2025-04-11

CVE-2025-32427-Formie has XSS vulnerability for importing forms

verbb/formie · GHSA-p9hh-mh5x-wvx3

medium2025-04-11

CVE-2025-71398-SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)

surrealdb/surrealdb · GHSA-5q9x-554g-9jgg

high2025-04-11

SurrealDB CPU exhaustion via custom functions result in total DoS

surrealdb/surrealdb · GHSA-pxw4-94j3-v9pf

low2025-04-11

SurrealDB no JavaScript script function default timeout could facilitate DoS

surrealdb/surrealdb · GHSA-3824-qmfq-2qv7

high2025-04-11

SurrealDB memory exhaustion via string::replace using regex

surrealdb/surrealdb · GHSA-3633-g6mg-p6qq

critical2025-04-11

CVE-2025-71392-SurrealDB server-takeover via SurrealQL injection on backup import

surrealdb/surrealdb · GHSA-ccj3-5p93-8p42

medium2025-04-11

CVE-2025-32395-Vite has an `server.fs.deny` bypass with an invalid `request-target`

vitejs/vite · GHSA-356w-63v5-8wf4

medium2025-04-11

CVE-2025-32027-Yii does not prevent XSS in scenarios where fallback error renderer is used

yiisoft/yii · GHSA-7r2v-8wxr-3ch5

low2025-04-10

SurrealDB has local file read of 2-column TSV files via analyzers

surrealdb/surrealdb · GHSA-2cvj-g5r5-jrrg

medium2025-04-10

SurrealDB vulnerable to memory exhaustion via nested functions and scripts

surrealdb/surrealdb · GHSA-m7rc-8w7m-r9qr

high2025-04-10

SurrealDB has uncaught exception in Net module that leads to database crash

surrealdb/surrealdb · GHSA-rq86-9m6r-cm3g

medium2025-04-10

Silverstripe Framework user enumeration via timing attack on login and password reset forms

silverstripe/silverstripe-framework · GHSA-256q-hx8w-xcqx

low2025-04-10

CVE-2025-24866-Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint

mattermost/mattermost · GHSA-xfq9-hh5x-xfq9

medium2025-04-10

CVE-2025-4574-crossbeam-channel Vulnerable to Double Free on Drop

crossbeam-rs/crossbeam · GHSA-pg9f-39pc-qf8g

medium2025-04-10

CVE-2025-32387-Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

helm/helm · GHSA-5xqw-8hwv-wg92