Security advisories

high2025-03-28

CVE-2024-57083-Redoc Prototype Pollution via `Module.mergeObjects` Component

redocly/redoc · GHSA-9rhg-254w-fh9x

medium2025-03-28

CVE-2024-6875-Infinispan Potential Out of Memory Error via REST Compare API Buffer API

infinispan/infinispan · GHSA-2q39-w2hw-2pjm

high2025-03-28

CVE-2024-38985-depath and cool-path vulnerable to Prototype Pollution via `set()` Method

janrywang/depath · GHSA-4h4x-4m75-47j4

low2025-03-28

CVE-2024-39311-Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction

publify/publify · GHSA-8fm5-gg2f-f66q

medium2025-03-28

CVE-2025-2888-tough timestamp metadata is cached when it fails snapshot rollback check

awslabs/tough · GHSA-76g3-38jv-wxh4

medium2025-03-28

CVE-2025-2887-tough failure to detect delegated target rollback

awslabs/tough · GHSA-q6r9-r9pw-4cf7

medium2025-03-28

CVE-2025-64346-github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

jaredallard/archives · GHSA-j95m-rcjp-q69h

high2025-03-27

CVE-2024-12905-tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File

mafintosh/tar-fs · GHSA-pq67-2wwv-3xjx

high2025-03-27

CVE-2025-29072-Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow

nethermindeth/juno · GHSA-wq32-8rp4-w2mc

high2025-03-27

CVE-2025-30358-Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks

mesop-dev/mesop · GHSA-f3mf-hm6v-jfhh

high2025-03-27

CVE-2025-30355-Synapse vulnerable to federation denial of service via malformed events

element-hq/synapse · GHSA-v56r-hwv5-mxg6

medium2025-03-27

CVE-2025-30221-Pitchfork HTTP Request/Response Splitting vulnerability

shopify/pitchfork · GHSA-pfqj-w6r6-g86v

medium2025-03-27

CVE-2025-27793-Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]

vega/vega · GHSA-963h-3v39-3pqf

low2025-03-27

CVE-2025-30067-Apache Kylin Code Injection via JDBC Configuration Alteration

apache/kylin · GHSA-29m8-wh9p-5wc4

low2025-03-27

CVE-2024-48944-Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint

apache/kylin · GHSA-3v67-545x-ffc3

medium2025-03-27

CVE-2025-26619-Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter

vega/vega · GHSA-rcw3-wmx7-cphr

low2025-03-26

Django TomSelect incomplete escaping of dangerous characters in widget attributes

omenapps/django-tomselect · GHSA-785h-76cm-cpmf

medium2025-03-26

xmas-elf potential out-of-bounds read with a malformed ELF file and the HashTable API.

nrc/xmas-elf · GHSA-9cc5-2pq7-hfj8

high2025-03-26

CVE-2025-30353-Directus's webhook trigger flows can leak sensitive data

directus/directus · GHSA-fm3h-p9wm-h74h

medium2025-03-26

CVE-2025-30352-Directus `search` query parameter allows enumeration of non permitted fields

directus/directus · GHSA-7wq3-jr35-275c