Security advisories

critical2025-04-02

CVE-2025-31477-Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`

tauri-apps/plugins-workspace · GHSA-c9pr-q8gx-3mgp

high2025-04-02

CVE-2025-31479-canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output

canonical/get-workflow-version-action · GHSA-26wh-cc3r-w6pj

low2025-04-02

CVE-2025-30218-Next.js may leak x-middleware-subrequest-id to external hosts

vercel/next.js · GHSA-223j-4rm8-mrmf

high2025-04-02

CVE-2025-29085-Vipshop Saturn Console Vulnerable to SQL Injection via ClusterKey Component

vipshop/saturn · GHSA-49v8-p6mm-3pfj

medium2025-04-02

CVE-2023-27592-Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler

miniflux/v2 · GHSA-mqqg-xjhj-wfgw

high2025-04-02

CVE-2023-27591-Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics

miniflux/v2 · GHSA-3qjf-qh38-x73v

medium2025-04-02

CVE-2025-31724-Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted

jenkinsci/vmanager-plugin · GHSA-x9hj-q7xv-fv4v

medium2025-04-02

CVE-2025-31728-Jenkins AsakusaSatellite Plugin Does not Mask API Keys via Job Configuration Form

jenkinsci/asakusa-satellite-plugin · GHSA-m254-f6h4-p93g

medium2025-04-02

CVE-2025-31723-Jenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)

jenkinsci/simple-queue-plugin · GHSA-hcfh-qjcp-34q9

medium2025-04-02

CVE-2025-31725-Jenkins monitor-remote-job Plugin Stores Passwords Unencrypted

jenkinsci/monitor-remote-job-plugin · GHSA-g65g-fmcp-4w68

medium2025-04-02

CVE-2025-31727-Jenkins AsakusaSatellite Plugin Stores API Keys Unencrypted in Job `config.xml` Files

jenkinsci/asakusa-satellite-plugin · GHSA-fv9q-fq62-c6qg

high2025-04-02

CVE-2025-31722-Jenkins Templating Engine Plugin Vulnerable to Arbitrary Code Execution

jenkinsci/templating-engine-plugin · GHSA-4vjp-327p-w4qv

medium2025-04-02

CVE-2025-31726-Jenkins Stack Hammer Plugin Stores API Keys Unencrypted in Job `config.xml` Files

jenkinsci/stackhammer-plugin · GHSA-2wxq-944j-5g2v

medium2025-04-02

CVE-2025-27556-Django Potential Denial of Service (DoS) on Windows

django/django · GHSA-wqfg-m96j-85vm

medium2025-04-02

CVE-2025-2842-Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

grafana/tempo-operator · GHSA-5xf3-gmx4-529v

medium2025-04-02

CVE-2025-2786-Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

grafana/tempo-operator · GHSA-28gr-56hr-prp6

high2025-04-02

CVE-2025-71319-image-size Denial of Service via Infinite Loop during Image Processing

image-size/image-size · GHSA-m5qc-5hw7-8vg7

low2025-04-02

PyO3 Risk of buffer overflow in `PyString::from_object`

pyo3/pyo3 · GHSA-pph8-gcv7-4qj5

medium2025-04-01

CVE-2025-31135-Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times

phires/go-guerrilla · GHSA-c2c3-pqw5-5p7c

high2025-04-01

CVE-2025-31137-Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

remix-run/react-router · GHSA-4q56-crqp-v477