Security advisories

medium2025-03-03

CVE-2025-1300-CodeChecker open redirect when URL contains multiple slashes after the product name

ericsson/codechecker · GHSA-g839-x3p3-g5fm

low2025-03-03

CVE-2025-27400-Magento LTS vulnerable to stored XSS in theme config fields

openmage/magento-lts · GHSA-5pxh-89cx-4668

low2025-03-03

CVE-2024-51091-seajs Cross-site Scripting vulnerability

seajs/seajs · GHSA-pfr4-4397-3hg8

low2025-03-03

CVE-2024-53384-tsup DOM Clobbering vulnerability

egoist/tsup · GHSA-3mv9-4h5g-vhg3

medium2025-03-03

CVE-2024-53388-mavo DOM Clobbering vulnerability

mavoweb/mavo · GHSA-3mf5-r4hg-hfx9

low2025-03-03

CVE-2024-55532-Apache Ranger Improper Neutralization of Formula Elements vulnerability

apache/ranger · GHSA-2h4w-p9fh-9rmv

high2025-03-03

CVE-2025-27421-Goroutine Leak in Abacus SSE Implementation

jasonlovesdoggo/abacus · GHSA-vh64-54px-qgf8

low2025-03-03

CVE-2025-24023-Flask-AppBuilder Observable Response Discrepancy

dpgaspar/flask-appbuilder · GHSA-p8q5-cvwx-wvwp

medium2025-03-03

CVE-2024-24778-Apache StreamPipes has improper privilege management in a REST interface

apache/streampipes · GHSA-vm7w-2724-5m23

medium2025-03-03

CVE-2024-53382-PrismJS DOM Clobbering vulnerability

prismjs/prism · GHSA-x7hr-w5r2-h6wg

medium2025-03-03

CVE-2024-53386-Stage.js DOM Clobbering vulnerabilty

piqnt/stage.js · GHSA-fp3m-g5rc-4c28

critical2025-03-03

CVE-2025-27590-Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account

ytti/oxidized-web · GHSA-jx6p-9c26-g373

high2025-03-01

Formwork improperly validates input of User role preventing site and panel availability

getformwork/formwork · GHSA-c85w-x26q-ch87

medium2025-03-01

Formwork has a cross-site scripting (XSS) vulnerability in Site title

getformwork/formwork · GHSA-vf6x-59hh-332f

high2025-02-28

CVE-2025-1686-Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro

pebbletemplates/pebble · GHSA-p75g-cxfj-7wrx

medium2025-02-28

ntpd NTS client denial of service via wrongly sized cookies

pendulum-project/ntpd-rs · GHSA-v83q-83hj-rw38

critical2025-02-28

IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement

cosmos/ibc-go · GHSA-jg6f-48ff-5xrw

high2025-02-28

CVE-2025-27154-Spotipy's cache file, containing spotify auth token, is created with overly broad permissions

spotipy-dev/spotipy · GHSA-pwhh-q4h6-w599

medium2025-02-27

CVE-2025-22952-Memos Server-Side Request Forgery (SSRF)

usememos/memos · GHSA-wfxg-v3j4-7qmj

high2025-02-27

CVE-2025-1756-mongosh vulnerable to local privilege escalation

mongodb-js/mongosh · GHSA-f5w3-73h4-jpcm