Security advisories

high2025-02-14

Uncaught Panic in ORML Rewards Pallet

open-web3-stack/open-runtime-module-library · GHSA-5v93-9mqw-p9mh

medium2025-02-14

CVE-2025-25204-`gh attestation verify` returns incorrect exit code during verification if no attestations are present

cli/cli · GHSA-fgw4-v983-mgp8

critical2025-02-14

CVE-2024-56180-Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution

apache/eventmesh · GHSA-ffvr-gmp3-xx43

high2025-02-14

CVE-2025-25297-Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

humansignal/label-studio · GHSA-m238-fmcw-wh58

medium2025-02-14

CVE-2025-25296-Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint

humansignal/label-studio · GHSA-wpq5-3366-mqw4

high2025-02-14

CVE-2025-25295-Label Studio has a Path Traversal Vulnerability via image Field

humansignal/label-studio-sdk · GHSA-rgv9-w7jp-m23g

critical2025-02-14

CVE-2024-52577-Apache Ignite: Possible RCE when deserializing incoming messages by the server node

apache/ignite · GHSA-8355-xj3p-hv6q

medium2025-02-14

CVE-2025-26791-DOMPurify allows Cross-site Scripting (XSS)

cure53/dompurify · GHSA-vhxf-7vqr-mrjg

medium2025-02-13

CVE-2025-0426-Node Denial of Service via kubelet Checkpoint API

kubernetes/kubernetes · GHSA-jgfp-53c3-624w

high2025-02-13

CVE-2025-26511-Instaclustr Cassandra-Lucene-Index allows bypass of Cassandra RBAC

instaclustr/cassandra-lucene-index · GHSA-mrqp-q7vx-v2cx

high2025-02-13

CVE-2025-1247-Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance

quarkusio/quarkus · GHSA-phg3-gv66-q38x

medium2025-02-13

CVE-2024-46910-Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user

apache/atlas · GHSA-x3v6-f5fr-4wwv

critical2025-02-13

CVE-2024-57604-MaysWind ezBookkeeping has Improper Privilege Management

mayswind/ezbookkeeping · GHSA-mpg8-8x9c-p9gv

critical2025-02-13

CVE-2024-57602-Easy!Appointments Improper Restriction of Excessive Authentication Attempts

alextselegidis/easyappointments · GHSA-8fc2-fhh6-f6m5

medium2025-02-13

CVE-2024-57603-Missing rate limit in MaysWind ezBookkeeping

mayswind/ezbookkeeping · GHSA-772m-773g-qmhc

medium2025-02-13

CVE-2024-57601-Remote code execution in alextselegidis/easyappointments

alextselegidis/easyappointments · GHSA-3wf7-83q3-948c

medium2025-02-12

Potential Denial-of-Service condition leading to temporary disability in IBC transfers to the native chain

cosmos/ibc-apps · GHSA-6fgm-x6ff-w78f

critical2025-02-12

Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header

islandora/crayfish · GHSA-c2p2-hgjg-9r3f

critical2025-02-12

Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)

indutny/elliptic · GHSA-vjh7-7g9h-fjfh

high2025-02-12

CVE-2025-25283-parse-duration has a Regex Denial of Service that results in event loop delay and out of memory

jkroso/parse-duration · GHSA-hcrg-fc28-fcg5