Security advisories

medium2025-04-04

CVE-2025-31130-gitoxide does not detect SHA-1 collision attacks

gitoxidelabs/gitoxide · GHSA-2frx-2596-x5r6

critical2025-04-04

CVE-2025-27520-BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

bentoml/bentoml · GHSA-33xw-247w-6hmc

high2025-04-04

CVE-2025-31489-MinIO performs incomplete signature validation for unsigned-trailer uploads

minio/minio · GHSA-wg47-6jq2-q2hh

high2025-04-04

CVE-2025-31487-The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server

xwiki-contrib/jira · GHSA-wc53-4255-gw3f

medium2025-04-04

CVE-2025-31486-Vite allows server.fs.deny to be bypassed with .svg or relative paths

vitejs/vite · GHSA-xcj6-pq6g-qj4x

high2025-04-04

CVE-2025-31485-GraphQL grant on a property might be cached with different objects

api-platform/core · GHSA-428q-q3vv-3fq3

medium2025-04-04

CVE-2025-31483-Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration

miniflux/v2 · GHSA-cq88-842x-2jhp

high2025-04-04

CVE-2025-31481-GraphQL query operations security can be bypassed

api-platform/core · GHSA-cg3c-245w-728m

high2025-04-04

CVE-2025-31119-generator-jhipster-entity-audit vulnerable to Unsafe Reflection when having Javers selected as Entity Audit Framework

jhipster/generator-jhipster-entity-audit · GHSA-7rmp-3g9f-cvq8

high2025-04-04

CVE-2025-30370-jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

jupyterlab/jupyterlab-git · GHSA-cj5w-8mjf-r5f8

medium2025-04-04

CVE-2025-3197-expand-object Vulnerable to Prototype Pollution via the expand() Function

jonschlinkert/expand-object · GHSA-4vjr-hfpp-2m7w

high2025-04-04

CVE-2025-3192-Browsershot Server-Side Request Forgery (SSRF) via setURL() Function

spatie/browsershot · GHSA-qw64-6vcc-8ghx

low2025-04-04

CVE-2025-3191-React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button

jpuri/react-draft-wysiwyg · GHSA-fq5x-7292-2p5r

high2025-04-04

CVE-2025-3194-bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function

no2chem/bigint-buffer · GHSA-3gc7-fjrx-p6mg

medium2025-04-03

CVE-2025-3163-InternLM LMDeploy code injection vulnerability

internlm/lmdeploy · GHSA-jfvg-qm4p-473x

medium2025-04-03

CVE-2025-3162-LMDeploy Improper Input Validation Vulnerability

internlm/lmdeploy · GHSA-7vc5-mjwp-c8fq

critical2025-04-03

CVE-2025-2945-pgAdmin 4 Vulnerable to Remote Code Execution

pgadmin-org/pgadmin4 · GHSA-g73c-fw68-pwx3

critical2025-04-03

CVE-2025-2946-pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering

pgadmin-org/pgadmin4 · GHSA-2rrx-pphc-qfv9

medium2025-04-03

CVE-2023-47639-API Platform Core can leak exceptions message that may contain sensitive information

api-platform/core · GHSA-rfw5-cqjj-7v9r

medium2025-04-03

CVE-2025-3153-Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS)

concretecms/concretecms · GHSA-cmm4-p9v2-q453