Security advisories

low2025-03-26

CVE-2025-30351-Suspended Directus user can continue to use session token to access API

directus/directus · GHSA-56p6-qw3c-fq2g

medium2025-03-26

CVE-2025-30350-Directus's S3 assets become unavailable after a burst of HEAD requests

directus/directus · GHSA-rv78-qqrq-73m5

medium2025-03-26

CVE-2025-30225-Directus's S3 assets become unavailable after a burst of malformed transformations

directus/directus · GHSA-j8xj-7jff-46mx

medium2025-03-26

CVE-2025-30217-Frappe has possibility of SQL injection due to improper validations

frappe/frappe · GHSA-6phg-4wmq-h5h3

low2025-03-26

CVE-2025-30222-Shescape has potential environment variable exposure on Windows with CMD

ericcornelissen/shescape · GHSA-66pp-5p9w-q87j

low2025-03-26

CVE-2025-2792-@mozilla/readability Denial of Service through Regex

mozilla/readability · GHSA-3p6v-hrg8-8qj7

medium2025-03-26

CVE-2024-11847-wp-svg-upload WordPress plugin vulnerable to Stored Cross-site Scripting

digimix/wp-svg-upload · GHSA-v2rr-fhv8-mx74

medium2025-03-25

CVE-2024-12369-WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack

wildfly-security/wildfly-elytron · GHSA-5565-3c98-g6jc

medium2025-03-25

CVE-2025-30741-Pixelfed may allow unauthorized actor to view private posts and private users

pixelfed/pixelfed · GHSA-7287-grhx-542x

high2025-03-25

CVE-2025-30214-Frappe vulnerable to information disclosure leading to account takeover

frappe/frappe · GHSA-qrv3-jc3h-f3m6

medium2025-03-25

CVE-2025-30213-Frappe has Possibility of Remote Code Execution due to improper validation

frappe/frappe · GHSA-v342-4xr9-x3q3

medium2025-03-25

CVE-2025-30212-Frappe has possibility of SQL injection due to improper validations

frappe/frappe · GHSA-3hj6-r5c9-q8f3

medium2025-03-25

CVE-2025-30208-Vite bypasses server.fs.deny when using ?raw??

vitejs/vite · GHSA-x574-m823-4x7w

medium2025-03-25

CVE-2025-2559-Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache

keycloak/keycloak · GHSA-2935-2wfm-hhpv

high2025-03-25

CVE-2025-1098-ingress-nginx controller - configuration injection via unsanitized mirror annotations

kubernetes/ingress-nginx · GHSA-vg63-w3p9-jc9m

critical2025-03-25

CVE-2025-1974-ingress-nginx admission controller RCE escalation

kubernetes/ingress-nginx · GHSA-mgvx-rpfc-9mpv

high2025-03-25

CVE-2025-24514-ingress-nginx controller - configuration injection via unsanitized auth-url annotation

kubernetes/ingress-nginx · GHSA-fwwp-xcxw-39vq

high2025-03-25

CVE-2025-1097-ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation

kubernetes/ingress-nginx · GHSA-823x-fv5p-h7hw

medium2025-03-25

CVE-2025-24513-ingress-nginx controller - auth secret file path traversal vulnerability

kubernetes/ingress-nginx · GHSA-242m-6h72-7hgp

high2025-03-24

CVE-2025-29314-OpenDaylight SFC Insecure Shiro Cookie Configuration

opendaylight/sfc · GHSA-xp75-w7vq-5x6j