Security advisories

medium2025-03-19

CVE-2025-27018-Apache Airflow MySQL Provider is Vulnerable to SQL Injection

apache/airflow · GHSA-hhm6-jjf4-6pm3

medium2025-03-19

CVE-2025-30081-Clickstorm SEO Allows Cross-Site Scripting (XSS)

clickstorm/cs_seo · GHSA-vmgw-24w6-9v82

high2025-03-18

CVE-2025-29907-jsPDF Bypass Regular Expression Denial of Service (ReDoS)

parallax/jspdf · GHSA-w532-jxjh-hjhj

medium2025-03-18

CVE-2025-29790-Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads

contao/contao · GHSA-vqqr-fgmh-f626

medium2025-03-18

CVE-2024-44314-TastyIgniter Has an Incorrect Access Control Vulnerability

tastyigniter/tastyigniter · GHSA-w5h7-mw56-4v7x

high2025-03-18

CVE-2024-44313-TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function

tastyigniter/tastyigniter · GHSA-gg2f-r4jh-vpmh

medium2025-03-18

CVE-2025-25500-CosmWasm Allows Bypass of Capability Restrictions in Blockchains

cosmwasm/cosmwasm · GHSA-cg8r-jwg7-r2x4

medium2025-03-17

CVE-2025-0495-buildx allows a possible credential leakage to telemetry endpoint

docker/buildx · GHSA-m4gq-fm9h-8q75

medium2025-03-17

CVE-2025-29788-Sylius PayPal Plugin Payment Amount Manipulation Vulnerability

sylius/paypalplugin · GHSA-pqq3-q84h-pj6x

high2025-03-17

CVE-2025-29787-zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write

zip-rs/zip2 · GHSA-94vh-gphv-8pm8

high2025-03-17

CVE-2025-29786-Memory Exhaustion in Expr Parser with Unrestricted Input

expr-lang/expr · GHSA-93mq-9ffx-83m2

medium2025-03-17

CVE-2025-29781-Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD

metal3-io/baremetal-operator · GHSA-c98h-7hp9-v9hq

medium2025-03-17

CVE-2024-40635-containerd has an integer overflow in User ID handling

containerd/containerd · GHSA-265r-hfxg-fhmg

high2025-03-17

CVE-2025-2241-Openshift Hive Exposes VCenter Credentials via ClusterProvision

openshift/hive · GHSA-c339-mwfc-fmr2

low2025-03-17

CVE-2025-1398-Mattermost Desktop App allows the bypass of Transparency, Consent, and Control (TCC) via code injection

mattermost/desktop · GHSA-xmvv-w44w-j8wx

high2025-03-17

PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash

davidosipov/postquantum-feldman-vss · GHSA-v432-7f47-9g94

low2025-03-17

CVE-2025-27512-Zincati allows unprivileged access to rpm-ostree D-Bus `Deploy()` and `FinalizeDeployment()` methods

coreos/zincati · GHSA-w6fv-6gcc-x825

medium2025-03-17

CVE-2025-30089-gurk (aka gurk-rs) mishandles ANSI escape sequences

boxdot/gurk-rs · GHSA-89xp-c3mq-qj84

medium2025-03-16

CVE-2024-58103-Wire has Uncontrolled Recursion on Nested Groups

square/wire · GHSA-pwf9-q62p-v7wc

medium2025-03-16

CVE-2025-30077-onos-lib-go allows an index out-of-range panic

onosproject/onos-lib-go · GHSA-jrqj-6vq2-7r63