Security advisories

high2025-03-15

CVE-2025-30066-tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

tj-actions/changed-files · GHSA-mrrh-fwg8-r2c3

critical2025-03-14

CVE-2025-2000-Qiskit allows arbitrary code execution decoding QPY format versions < 13

qiskit/qiskit · GHSA-6m2c-76ff-6vrf

medium2025-03-14

CVE-2025-29779-Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`

davidosipov/postquantum-feldman-vss · GHSA-r8gc-qc2c-c7vh

medium2025-03-14

CVE-2025-29780-Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations

davidosipov/postquantum-feldman-vss · GHSA-q65w-fg65-79f4

medium2025-03-14

CVE-2025-29771-JS Html Sanitizer allows XSS when used with contentEditable

jitbit/htmlsanitizer · GHSA-vhv4-fh94-jm5x

high2025-03-14

Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

sparklemotion/nokogiri · GHSA-mrxw-mxhj-p664

critical2025-03-14

Flowise allows arbitrary file write to RCE

flowiseai/flowise · GHSA-8vvx-qvq9-5948

medium2025-03-14

CVE-2024-29409-nest allows a remote attacker to execute arbitrary code via the Content-Type header

nestjs/nest · GHSA-cj7v-w2c7-cp7c

high2025-03-14

CVE-2025-29776-In Azle, calling `setTimer` causes infinite loop of timers

demergent-labs/azle · GHSA-xc76-5pf9-mx8m

critical2025-03-14

CVE-2025-29775-xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

node-saml/xml-crypto · GHSA-x3m8-899r-f7c3

critical2025-03-14

CVE-2025-29774-xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

node-saml/xml-crypto · GHSA-9p8x-f768-wp2g

critical2025-03-14

CVE-2025-2304-Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment

owen2345/camaleon-cms · GHSA-rp28-mvq3-wf8j

critical2025-03-13

Flowise Pre-auth Arbitrary File Upload

flowiseai/flowise · GHSA-h42x-xx2q-6v6g

low2025-03-13

CVE-2025-27496-Snowflake JDBC Driver client-side encryption key in DEBUG logs

snowflakedb/snowflake-jdbc · GHSA-q298-375f-5q63

medium2025-03-13

CVE-2024-9042-Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API

kubernetes/kubernetes · GHSA-vv39-3w5q-974q

medium2025-03-13

CVE-2025-1767-Kubernetes GitRepo Volume Inadvertent Local Repository Access

kubernetes/kubernetes · GHSA-3wgm-2gw2-vh5m

low2025-03-13

CVE-2025-28010-MODX allows cross-site scripting (XSS) via an SVG file

modxcms/revolution · GHSA-hm54-fg2w-2g6j

critical2025-03-13

cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)

cheqd/cheqd-node · GHSA-h2rp-8vpx-q9r4

medium2025-03-13

CVE-2020-36843-Ed25519 Signature Malleability in ed25519-java Due to Missing Scalar Range Check

str4d/ed25519-java · GHSA-p53j-g8pw-4w5f

medium2025-03-12

CVE-2025-27794-Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

flarum/framework · GHSA-hg9j-64wp-m9px