Security advisories

high2025-02-27

CVE-2025-23389-Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login

rancher/rancher · GHSA-mq23-vvg7-xfm4

high2025-02-27

CVE-2025-23388-Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API

rancher/rancher · GHSA-xr9q-h9c7-xw8q

medium2025-02-27

CVE-2025-23387-Rancher's SAML-based login via CLI can be denied by unauthenticated users

rancher/rancher · GHSA-5qmp-9x47-92q8

low2025-02-27

CVE-2025-1693-MongoDB Shell may be susceptible to control character Injection via shell output

mongodb-js/mongosh · GHSA-r95j-4jvf-mrrw

medium2025-02-27

CVE-2025-1692-MongoDB Shell may be susceptible to control character injection via pasting

mongodb-js/mongosh · GHSA-973h-3x6p-qg37

high2025-02-27

CVE-2025-1691-MongoDB Shell may be susceptible to Control Character Injection via autocomplete

mongodb-js/mongosh · GHSA-43g5-2wr2-q7vj

medium2025-02-26

CVE-2022-25773-Mautic allows Relative Path Traversal in assets file upload

mautic/mautic · GHSA-4w2w-36vm-c8hf

high2025-02-26

CVE-2024-47053-Mautic allows Improper Authorization in Reporting API

mautic/mautic · GHSA-8xv7-g2q3-fqgc

critical2025-02-26

CVE-2024-47051-Mautic allows Remote Code Execution and File Deletion in Asset Uploads

mautic/mautic · GHSA-73gx-x7r9-77x2

low2025-02-26

CVE-2025-27145-copyparty renders unsanitized filenames as HTML when user uploads empty files

9001/copyparty · GHSA-m2jw-cj8v-937r

high2025-02-26

CVE-2025-1634-io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout

quarkusio/quarkus · GHSA-4fwr-mh5q-hchh

low2025-02-25

CVE-2025-27146-Matrix IRC Bridge allows IRC command injection to own puppeted user

matrix-org/matrix-appservice-irc · GHSA-5mvm-89c9-9gm5

high2025-02-25

CVE-2025-27108-DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace

ryansolid/dom-expressions · GHSA-hw62-58pr-7wc5

high2025-02-25

CVE-2025-27109-Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)

solidjs/solid · GHSA-3qxh-p7jc-5xh6

medium2025-02-25

CVE-2025-27112-Navidrome allows an authentication bypass in Subsonic API with non-existent username

navidrome/navidrome · GHSA-c3p4-vm8f-386p

critical2025-02-25

CVE-2023-25574-LTI JupyterHub Authenticator does not properly validate JWT Signature

jupyterhub/ltiauthenticator · GHSA-mcgx-2gcr-p3hp

medium2025-02-24

CVE-2025-27144-DoS in go-jose Parsing

go-jose/go-jose · GHSA-c6gw-w398-hv78

high2025-02-24

CVE-2025-26529-Moodle has a stored XSS risk in admin live log

moodle/moodle · GHSA-wr88-x8cm-7cgq

high2025-02-24

CVE-2025-26533-Moodle has a SQL injection risk in course search module list filter

moodle/moodle · GHSA-rg56-94j7-hjx9

medium2025-02-24

CVE-2025-26526-Moodle's feedback response viewing and deletions did not respect Separate Groups mode

moodle/moodle · GHSA-pxg4-xjp7-w9c5