Security advisories

high2025-03-11

CVE-2025-27591-Below has Incorrect Permission Assignment for Critical Resource

facebookincubator/below · GHSA-9mc5-7qhg-fp3w

medium2025-03-11

CVE-2025-48958-Froxlor has an HTML Injection Vulnerability

froxlor/froxlor · GHSA-26xq-m8xw-6373

medium2025-03-11

CVE-2025-29773-Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover

froxlor/froxlor · GHSA-7j6w-p859-464f

medium2025-03-11

CVE-2025-27789-Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups

babel/babel · GHSA-968p-4wvh-cqc8

high2025-03-11

CVE-2025-1550-Arbitrary Code Execution via Crafted Keras Config for Model Loading

keras-team/keras · GHSA-48g7-3x6r-xfhp

high2025-03-11

CVE-2025-24070-Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability

dotnet/aspnetcore · GHSA-2865-hh9g-w894

high2025-03-11

CVE-2025-27773-The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding

simplesamlphp/saml2 · GHSA-46r4-f8gj-xg56

medium2025-03-11

CVE-2025-24986-Azure PromptFlow remote code execution related to Jinja templates

microsoft/promptflow · GHSA-gprr-v9f2-px3c

high2025-03-11

CVE-2025-59049-Mockoon has a Path Traversal and LFI in the static file serving endpoint

mockoon/mockoon · GHSA-w7f9-wqc4-3wxr

medium2025-03-11

CVE-2025-27602-Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

umbraco/umbraco-cms · GHSA-wx5h-wqfq-v698

medium2025-03-11

CVE-2025-27601-Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality

umbraco/umbraco-cms · GHSA-6ffg-mjg7-585x

high2025-03-11

CVE-2025-27403-Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries

ratify-project/ratify · GHSA-44f7-5fj5-h4px

high2025-03-10

CVE-2025-27616-Vela Server Has Insufficient Webhook Payload Data Verification

go-vela/server · GHSA-9m63-33q3-xq5x

high2025-03-10

CVE-2025-27610-Local File Inclusion in Rack::Static

rack/rack · GHSA-7wqh-767x-r66v

medium2025-03-10

CVE-2025-0660-Concrete CMS affected by a stored XSS in Folder Function.The "Add Folder" functionality

concretecms/concretecms · GHSA-pvmx-mjmh-jfcx

medium2025-03-10

CVE-2025-1391-Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims

keycloak/keycloak · GHSA-gvgg-2r3r-53x7

medium2025-03-10

CVE-2025-0604-Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak

keycloak/keycloak · GHSA-2p82-5wwr-43cw

medium2025-03-10

PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()

pmmp/pocketmine-mp · GHSA-g274-c6jj-h78p

medium2025-03-10

CVE-2024-52812-LF Edge eKuiper allows Stored XSS in Rules Functionality

lf-edge/ekuiper · GHSA-6hrw-x7pr-4mp8

medium2025-03-10

CVE-2025-1296-Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs

hashicorp/nomad · GHSA-c3q9-q986-vrwh