Security advisories

medium2025-04-07

CVE-2025-32014-estree-util-value-to-estree allows prototype pollution in generated ESTree

remcohaszing/estree-util-value-to-estree · GHSA-f7f6-9jq7-3rqj

high2025-04-07

CVE-2025-31496-Apollo Compiler Named Fragment Processing Vulnerability

apollographql/apollo-rs · GHSA-7mpv-9xg6-5r79

high2025-04-07

CVE-2025-32031-Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

apollographql/federation · GHSA-p2q6-pwh5-m6jr

high2025-04-07

CVE-2025-32030-Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

apollographql/federation · GHSA-q2f9-x4p4-7xmh

high2025-04-07

CVE-2025-32380-Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing

apollographql/router · GHSA-3j43-9v8v-cp3f

high2025-04-07

CVE-2025-32033-Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow

apollographql/router · GHSA-84m6-5m72-45fp

high2025-04-07

CVE-2025-32034-Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

apollographql/router · GHSA-75m2-jhh5-j5g2

high2025-04-07

CVE-2025-32032-Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

apollographql/router · GHSA-94hh-jmq8-2fgp

medium2025-04-07

CVE-2025-71332-FlowiseDB vulnerable to SQL Injection by authenticated users

flowiseai/flowise · GHSA-9c4c-g95m-c8cp

medium2025-04-07

Picklescan failed to detect to some unsafe global function in Numpy library

mmaitre314/picklescan · GHSA-fj43-3qmq-673f

high2025-04-07

CVE-2025-46417-Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate

mmaitre314/picklescan · GHSA-93mv-x874-956g

high2025-04-07

CVE-2025-28269-js-object-utilities Vulnerable to Prototype Pollution

rrainn/js-object-utilities · GHSA-hpqf-m68j-2pfx

critical2025-04-07

CVE-2025-32013-LNbits Lightning Network Payment System Vulnerable to Server-Side Request Forgery via LNURL Authentication Callback

lnbits/lnbits · GHSA-qp8j-p87f-c8cc

medium2025-04-07

CVE-2025-31476-tarteaucitron.js allows url scheme injection via unfiltered inputs

amauric/tarteaucitron.js · GHSA-p5g4-v748-6fh8

medium2025-04-07

Jujutsu does not have SHA-1 collision detection

jj-vcs/jj · GHSA-794x-2rpg-rfgr

medium2025-04-07

CVE-2025-31475-tarteaucitron.js allows prototype pollution via custom text injection

amauric/tarteaucitron.js · GHSA-4hwx-xcc5-2hfc

medium2025-04-07

CVE-2025-31138-tarteaucitron.js allows UI manipulation via unrestricted CSS injection

amauric/tarteaucitron.js · GHSA-7524-3396-fqv3

medium2025-04-07

CVE-2025-30373-Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value

graylog2/graylog2-server · GHSA-q7g5-jq6p-6wvx

high2025-04-07

CVE-2025-30473-Apache Airflow Common SQL Provider Vulnerable to SQL Injection

apache/airflow · GHSA-5r62-mjf5-xwhj

medium2025-04-04

rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`

sfackler/rust-openssl · GHSA-4fcv-w3qc-ppgg