Security advisories

medium2025-04-10

CVE-2025-32386-Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

helm/helm · GHSA-4hfp-h4cw-hj8p

medium2025-04-10

CVE-2025-30148-Silverstripe Framework has a XSS vulnerability in HTML editor

silverstripe/silverstripe-framework · GHSA-rhx4-hvx9-j387

medium2025-04-10

CVE-2025-25197-Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report

silverstripe/silverstripe-elemental · GHSA-x8xm-c7p8-2pj2

high2025-04-10

ibexa/fieldtype-richtext allows access to external entities in XML

ibexa/fieldtype-richtext · GHSA-cj3w-g42v-wcj6

high2025-04-10

ezsystems/ezplatform-richtext allows access to external entities in XML

ezsystems/ezplatform-richtext · GHSA-2jqj-5qv2-xvcg

critical2025-04-10

CVE-2024-58136-yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

yiisoft/yii2 · GHSA-ggwg-cmwp-46r5

medium2025-04-09

CVE-2025-32016-Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs

azuread/microsoft-identity-web · GHSA-rpq8-q44m-2rpg

medium2025-04-09

CVE-2025-27391-Apache ActiveMQ Artemis Vulnerable to Insertion of Sensitive Information into Log File

apache/activemq-artemis · GHSA-pm4j-p7pm-fpvx

low2025-04-09

CVE-2025-32378-Shopware default newsletter opt-in settings allow for mass sign-up abuse

shopware/shopware · GHSA-4h9w-7vfp-px8m

medium2025-04-09

wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities

wallabag/wallabag · GHSA-5pm7-cp8f-p2c2

medium2025-04-09

CVE-2025-32381-xgrammar Vulnerable to Denial of Service (DoS) by abusing unbounded cache in memory

mlc-ai/xgrammar · GHSA-389x-67px-mjg3

high2025-04-09

tendermint-rs's Light Client Verifier allows malicious validators to spoof votes from other validators

informalsystems/tendermint-rs · GHSA-6jrf-4jv4-r9mw

medium2025-04-09

CVE-2025-32379-Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function

koajs/koa · GHSA-x2rg-q646-7m2v

critical2025-04-09

CVE-2025-32375-BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

bentoml/bentoml · GHSA-7v4r-c989-xh26

medium2025-04-09

CVE-2025-32372-DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)

dnnsoftware/dnn.platform · GHSA-3f7v-qx94-666m

medium2025-04-09

CVE-2025-32025-bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing

bep/imagemeta · GHSA-fmhh-rw3h-785m

medium2025-04-09

CVE-2025-32024-bep/imagemeta allows excessively large EXIF data structures

bep/imagemeta · GHSA-q7rw-w4cq-2j6w

high2025-04-09

CVE-2025-32020-crud-query-parser SQL Injection vulnerability

guichaguri/crud-query-parser · GHSA-9r25-rp3p-h2w4

high2025-04-09

CVE-2025-32017-Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users

umbraco/umbraco-cms · GHSA-q62r-8ppj-xvf4

medium2025-04-09

CVE-2025-30677-Apache Pulsar Kafka Connector Logs Sensitive Information in Application Logs

apache/pulsar · GHSA-rcqj-3fmp-5cqx