Security advisories

high2025-02-20

CVE-2025-1293-Hermes improperly validates a JWT

hashicorp-forge/hermes · GHSA-vxm9-8mfw-vc6g

medium2025-02-20

CVE-2025-23020-Kwik hash collision vulnerability

ptrd/kwik · GHSA-9f57-9rhg-4hvm

medium2025-02-19

CVE-2025-27090-SSRF in sliver teamserver

bishopfox/sliver · GHSA-fh4v-v779-4g2w

medium2025-02-19

CVE-2025-25196-OpenFGA Authorization Bypass

openfga/openfga · GHSA-g4v5-6f5p-m38j

low2025-02-19

CVE-2025-24806-Authelia applies regulation separately to Username-based logins to Email-based logins

authelia/authelia · GHSA-m5mf-3963-4x26

medium2025-02-19

CVE-2025-26620-Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens

duendesoftware/foss · GHSA-qxj7-2x7w-3mpp

medium2025-02-19

CVE-2025-27089-Directus allows updates to non-allowed fields due to overlapping policies

directus/directus · GHSA-99vm-5v2h-h6r6

low2025-02-18

Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

sparklemotion/nokogiri · GHSA-vvfq-8hwr-qm4m

high2025-02-18

CVE-2025-25305-Home Assistant does not correctly validate SSL for outgoing requests in core and used libs

home-assistant/core · GHSA-m3pm-rpgg-5wj6

critical2025-02-18

CVE-2025-24895-AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass

italia/cie-aspnetcore · GHSA-vq63-8f72-f486

critical2025-02-18

CVE-2025-24894-The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass

italia/spid-aspnetcore · GHSA-36h8-r92j-w9vw

low2025-02-18

CVE-2024-4028-Keycloak allows cross-site scripting (XSS)

keycloak/keycloak · GHSA-q4xq-445g-g6ch

high2025-02-15

CVE-2025-1302-JSONPath Plus allows Remote Code Execution

jsonpath-plus/jsonpath · GHSA-hw8r-x6gr-5gjp

medium2025-02-14

CVE-2025-1057-Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0

keylime/keylime · GHSA-9jxq-5x44-gx23

medium2025-02-14

CVE-2025-25290-@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

octokit/request.js · GHSA-rmvr-2pp2-xj38

medium2025-02-14

CVE-2025-25289-@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

octokit/request-error.js · GHSA-xx4v-prfh-6cgc

medium2025-02-14

CVE-2025-25288-@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

octokit/plugin-paginate-rest.js · GHSA-h5c3-5r3r-rr8q

medium2025-02-14

CVE-2025-25285-@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

octokit/endpoint.js · GHSA-x4c5-c7rf-jjgv

medium2025-02-14

CVE-2025-25304-Vega allows Cross-site Scripting via the vlSelectionTuples function

vega/vega · GHSA-mp7w-mhcv-673j

low2025-02-14

Fyrox has unsound usages of `Vec::from_raw_parts`

fyroxengine/fyrox · GHSA-h7h7-6mx3-r89v