Security advisories

critical2025-03-21

CVE-2024-12029-InvokeAI Deserialization of Untrusted Data vulnerability

invoke-ai/invokeai · GHSA-mcrp-whpw-jp68

high2025-03-21

CVE-2025-30160-Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form

redlib-org/redlib · GHSA-g8vq-v3mg-7mrg

medium2025-03-21

CVE-2025-30157-Envoy crashes when HTTP ext_proc processes local replies

envoyproxy/envoy · GHSA-cf3q-gqg7-3fm9

critical2025-03-21

CVE-2025-29927-Authorization Bypass in Next.js Middleware

vercel/next.js · GHSA-f82v-jwr5-mffw

medium2025-03-21

CVE-2025-27612-Libcontainer is affected by capabilities elevation similar to GHSA-f3fp-gc8g-vw66

youki-dev/youki · GHSA-5w4j-f78p-4wh9

medium2025-03-21

CVE-2025-27933-Mattermost allows members with permission to convert public channels to private and convert private to public

mattermost/mattermost · GHSA-h5v9-xw2g-7hrq

low2025-03-21

CVE-2025-27715-Mattermost fail to prompt for explicit approval before adding a team admin to a private channel

mattermost/mattermost · GHSA-cw7q-5cgc-h3h9

medium2025-03-21

CVE-2025-30179-Mattermost Fails to Enforce Certain Search APIs

mattermost/mattermost · GHSA-3gpx-p63p-pr5r

medium2025-03-21

CVE-2025-24920-Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels

mattermost/mattermost · GHSA-rp74-x43m-cpw3

high2025-03-21

CVE-2025-25068-Mattermost Fails to Enforce MFA on Plugin Endpoints

mattermost/mattermost · GHSA-72qv-j8vr-xvfv

medium2025-03-21

CVE-2025-25274-Mattermost Fails to Restrict Command Execution in Archived Channels

mattermost/mattermost · GHSA-4v65-xqcj-wpgg

low2025-03-20

CVE-2025-29923-go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment

redis/go-redis · GHSA-92cp-5422-2mw7

critical2025-03-20

CVE-2025-29922-kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

kcp-dev/kcp · GHSA-w2rr-38wv-8rrp

medium2025-03-20

CVE-2025-29914-OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`

corazawaf/coraza · GHSA-q9f5-625g-xm39

medium2025-03-20

CVE-2025-2565-Liferay Portal and Liferay DXP Reveals Data via Forms

liferay/liferay-portal · GHSA-9fcg-wrp8-qhr4

low2025-03-20

CVE-2024-7598-Kubernetes kube-apiserver Vulnerable to Race Condition

kubernetes/kubernetes · GHSA-r56h-j38w-hrqq

medium2025-03-20

CVE-2025-1473-MLflow Cross-Site Request Forgery (CSRF) vulnerability

mlflow/mlflow · GHSA-969w-gqqr-g6j3

low2025-03-20

CVE-2025-1474-MLflow has Weak Password Requirements

mlflow/mlflow · GHSA-4rj2-9gcx-5qhx

medium2025-03-20

CVE-2025-27888-Apache Druid vulnerable to Server-Side Request Forgery, Cross-site Scripting, Open Redirect

apache/druid · GHSA-2xcr-p767-f3rv

high2025-03-20

CVE-2025-0312-Ollama Denial of Service (DoS) via Null Pointer Dereference

ollama/ollama · GHSA-p2wh-w96x-w232