Security advisories

high2025-03-07

CVE-2025-27604-com.xwiki.confluencepro:application-confluence-migrator-pro-ui's application homepage is public

xwikisas/application-confluence-migrator-pro · GHSA-3w9f-2pph-j5vc

critical2025-03-07

CVE-2025-27603-com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations

xwikisas/application-confluence-migrator-pro · GHSA-6qvp-39mm-95v8

high2025-03-07

CVE-2025-27597-Vue I18n Allows Prototype Pollution in `handleFlatJson`

intlify/vue-i18n · GHSA-p2ph-7g93-hw3m

high2025-03-07

CVE-2025-27152-axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

axios/axios · GHSA-jr5f-v2jv-69x6

high2025-03-06

DoS Vulnerability in TraceContextPropagator.Extract - OpenTelemetry.Api

open-telemetry/opentelemetry-dotnet-instrumentation · GHSA-vc29-vg52-6643

high2025-03-06

CVE-2025-27598-Out-of-bounds Write in SixLabors ImageSharp

sixlabors/imagesharp · GHSA-2cmq-823j-5qj8

medium2025-03-06

CVE-2025-26699-Django vulnerable to Allocation of Resources Without Limits or Throttling

django/django · GHSA-p3fp-8748-vqfq

critical2025-03-06

CVE-2025-27509-Fleet has SAML authentication vulnerability due to improper SAML response validation

fleetdm/fleet · GHSA-52jx-g6m5-h735

medium2025-03-06

CVE-2025-25294-Envoy Gateway Log Injection Vulnerability

envoyproxy/gateway · GHSA-mf24-chxh-hmvj

medium2025-03-06

CVE-2025-27506-NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

nocodb/nocodb · GHSA-wf6c-hrhf-86cw

medium2025-03-06

CVE-2025-1979-ray vulnerable to Insertion of Sensitive Information into Log File

ray-project/ray · GHSA-w4rh-fgx7-q63m

medium2025-03-06

CVE-2025-27623-Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission

jenkinsci/jenkins · GHSA-rfh6-9r2q-98vf

medium2025-03-06

CVE-2025-27622-Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission

jenkinsci/jenkins · GHSA-p34j-r3ch-c985

medium2025-03-06

CVE-2025-27625-Jenkins Open Redirect vulnerability

jenkinsci/jenkins · GHSA-8hmv-92wm-39ch

medium2025-03-06

CVE-2025-27624-Jenkins cross-site request forgery (CSRF) vulnerability

jenkinsci/jenkins · GHSA-7g95-jmg9-h524

high2025-03-05

CVE-2025-27508-Emissary May Use a Broken or Risky Cryptographic Algorithm

nationalsecurityagency/emissary · GHSA-hw43-fcmm-3m5g

high2025-03-05

CVE-2025-25362-Spacy-LLM Server-Side Template Injection (SSTI) vulnerability

explosion/spacy-llm · GHSA-793v-gxfp-9q9h

medium2025-03-05

CVE-2025-27516-Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

pallets/jinja · GHSA-cpwx-vrp4-4pq7

high2025-03-05

dmlc/dgl Vulnerable to Remote Code Execution by Pickle Deserialization via rpc.recv_request()

dmlc/dgl · GHSA-3x5x-fw77-g54c

critical2025-03-05

CVE-2025-27517-Volt Allows RCE Via User-Crafted Requests

livewire/volt · GHSA-v69f-5jxm-hwvv