Security advisories

critical2025-03-24

CVE-2025-29315-OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request

opendaylight/sfc · GHSA-x65v-g96x-c6gw

high2025-03-24

CVE-2025-29313-OpenDaylight SFC Denial of Service (DoS)

opendaylight/sfc · GHSA-v3vp-fg2v-g7q4

medium2025-03-24

Web Push Denial of Service via malicious Web Push endpoint

pimeys/rust-web-push · GHSA-fc83-9jwq-gc2m

low2025-03-24

CVE-2025-30163-Cilium node based network policies may incorrectly allow workload traffic

cilium/cilium · GHSA-c6pf-2v8j-96mc

medium2025-03-24

CVE-2025-29778-Kyverno ignores subjectRegExp and IssuerRegExp

kyverno/kyverno · GHSA-46mp-8w32-6g94

low2025-03-24

CVE-2025-30162-Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers

cilium/cilium · GHSA-24qp-4xx8-3jvj

medium2025-03-24

CVE-2025-22223-Spring Security Vulnerable to Authorization Bypass via Security Annotations

spring-projects/spring-security · GHSA-hh3m-g4qj-4835

medium2025-03-24

CVE-2025-23204-API Platform Core does not call GraphQl securityAfterResolver

api-platform/core · GHSA-7mxx-3cgm-xxv3

medium2025-03-24

pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints

radekvit/pared · GHSA-vgmh-mqm4-8j88

low2025-03-24

AWS CDK CodePipeline: trusted entities are too broad

aws/aws-cdk · GHSA-5pq3-h73f-66hr

medium2025-03-24

CVE-2025-2689-yiisoft Yii2 Deserialization of Untrusted Data

yiisoft/yii2 · GHSA-88m2-j94x-v4fx

medium2025-03-24

CVE-2025-2699-GetmeUK ContentTools Cross-Site Scripting (XSS)

getmeuk/contenttools · GHSA-4f2v-2gpq-qhjg

high2025-03-23

CVE-2025-27553-Apache Commons VFS Has Relative Path Traversal Vulnerability

apache/commons-vfs · GHSA-9q4x-fr4m-jp86

medium2025-03-23

CVE-2025-30474-Apache Commons VFS Exposure of Sensitive Information to an Unauthorized Actor

apache/commons-vfs · GHSA-3936-3gx6-49c4

medium2025-03-22

CVE-2025-26796-Apache Oozie Cross-Site Scripting (XSS)

apache/oozie · GHSA-fmxw-76xq-cmqq

low2025-03-21

CVE-2025-45286-Reflected XSS in go-httpbin due to unrestricted client control over Content-Type

mccutchen/go-httpbin · GHSA-528q-4pgm-wvg2

high2025-03-21

CVE-2025-30204-jwt-go allows excessive memory allocation during header parsing

golang-jwt/jwt · GHSA-mh63-6h87-95cp

high2025-03-21

CVE-2024-53351-PipeCD Vulnerable to Privilege Escalation

pipe-cd/pipecd · GHSA-4jhw-c53w-w5r7

medium2025-03-21

CVE-2025-2598-AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

aws/aws-cdk · GHSA-v63m-x9r9-8gqp

medium2025-03-21

CVE-2025-30168-Parse Server has an OAuth login vulnerability

parse-community/parse-server · GHSA-837q-jhwx-cmpv