Security advisories

high2025-03-12

CVE-2025-25975-Prototype Pollution Vulnerability in parse-git-config

jonschlinkert/parse-git-config · GHSA-8g77-54rh-46hx

critical2025-03-12

CVE-2025-25292-Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)

saml-toolkits/ruby-saml · GHSA-754f-8gm6-c4r2

critical2025-03-12

CVE-2025-25291-Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)

saml-toolkits/ruby-saml · GHSA-4vc4-m8qh-g8jm

high2025-03-12

CVE-2025-25293-Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses

saml-toolkits/ruby-saml · GHSA-92rq-c8cf-prrq

critical2025-03-12

omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue

omniauth/omniauth-saml · GHSA-hw46-3hmr-x9xv

critical2025-03-12

IBC-Go: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt

cosmos/ibc-go · GHSA-4wf3-5qj9-368v

high2025-03-12

Cosmos SDK: x/group can halt when erroring in EndBlocker

cosmos/cosmos-sdk · GHSA-47ww-ff84-4jrg

critical2025-03-12

CVE-2025-27407-graphql allows remote code execution when loading a crafted GraphQL schema

rmosolgo/graphql-ruby · GHSA-q92j-grw3-h492

medium2025-03-12

CVE-2025-27017-Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record

apache/nifi · GHSA-35gq-cvrm-xf94

medium2025-03-12

CVE-2025-27867-Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin

apache/felix-dev · GHSA-2cv6-4f2r-jq2c

medium2025-03-12

laravel-crud-wizard-free has File Validation Bypass

macropay-solutions/laravel-crud-wizard-free · GHSA-3wgq-h4fr-cwg5

high2025-03-12

CVE-2025-27788-Out-of-bounds Read in Ruby JSON Parser

ruby/json · GHSA-9m3q-rhmv-5q44

high2025-03-12

CVE-2025-2240-SmallRye Fault Tolerance out-of-memory (OOM) issue

smallrye/smallrye-fault-tolerance · GHSA-gfh6-3pqw-x2j4

medium2025-03-12

CVE-2025-29891-Apache Camel Message Header Injection through request parameters

apache/camel · GHSA-96v5-c2h5-56hm

medium2025-03-12

CVE-2024-27763-XPixelGroup BasicSR Command Injection

xpixelgroup/basicsr · GHSA-86w8-vhw6-q9qq

low2025-03-12

CVE-2025-2214-Microweber vulnerable to XSS attack due to insure `group` component in its Settings handler

microweber/microweber · GHSA-hcgh-r5gq-6qc2

critical2025-03-11

cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement

cheqd/cheqd-node · GHSA-33cr-m232-xqch

medium2025-03-11

CVE-2025-27617-Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

pimcore/pimcore · GHSA-qjpx-5m2p-5pgh

high2025-03-11

CVE-2025-25302-Rembg CORS misconfiguration

danielgatis/rembg · GHSA-59qh-fmm7-3g9q

medium2025-03-11

CVE-2025-25301-Rembg allows SSRF via /api/remove

danielgatis/rembg · GHSA-r5gx-c49x-h878