Security advisories

high2025-02-05

CVE-2025-1022-Browsershot Path Traversal

spatie/browsershot · GHSA-j2gw-r24m-j2qw

medium2025-02-05

CVE-2025-1026-Browsershot Local File Inclusion

spatie/browsershot · GHSA-f2q5-6mx7-q9qq

high2025-02-04

CVE-2025-0509-Sparkle Signing Checks Bypass

sparkle-project/sparkle · GHSA-wc9m-r3v6-9p5h

high2025-02-04

MarbleRun unauthenticated recovery allows Coordinator impersonation

edgelesssys/marblerun · GHSA-w7wm-2425-7p2h

medium2025-02-04

wasmvm: Malicious smart contract can slow down block production

cosmwasm/wasmvm · GHSA-mx2j-7cmv-353c

medium2025-02-04

wasmvm: Malicious smart contract can crash the chain

cosmwasm/wasmvm · GHSA-23qp-3c2m-xx6w

critical2025-02-04

CVE-2025-24964-Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

vitest-dev/vitest · GHSA-9crc-q9x8-hgqq

medium2025-02-04

CVE-2025-24963-Vitest browser mode serves arbitrary files

vitest-dev/vitest · GHSA-8gvc-j273-4wm5

high2025-02-04

CVE-2025-23015-Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions

apache/cassandra · GHSA-wmcc-9vch-jmx4

medium2025-02-04

CVE-2024-27137-Apache Cassandra: unrestricted deserialization of JMX authentication credentials

apache/cassandra · GHSA-rgfx-7p65-3ff4

medium2025-02-04

CVE-2025-24860-Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions

apache/cassandra · GHSA-3cjf-fwcq-xh22

low2025-02-04

CVE-2025-0148-Jenkins Zoom Plugin is Missing Password Field Masking

jenkinsci/zoom-plugin · GHSA-4352-jxwg-88rm

medium2025-02-03

CVE-2025-24959-ZX Allows Environment Variable Injection for dotenv API

google/zx · GHSA-qwp8-x4ff-5h87

medium2025-02-03

CVE-2025-24898-rust-openssl ssl::select_next_proto use after free

sfackler/rust-openssl · GHSA-rpmj-rpgj-qmpm

medium2025-02-03

CVE-2025-24961-S3Proxy allows insecure path traversal in filesystem and filesystem-nio2 storage backends

gaul/s3proxy · GHSA-2ccp-vqmv-4r4x

high2025-02-03

CometBFT allows a malicious peer to stall the network by disseminating seemingly valid block parts

cometbft/cometbft · GHSA-r3r4-g7hq-pq4f

medium2025-02-03

TShock allows chat while not fully connected, possible ban evasion

pryaxis/tshock · GHSA-f8mx-cwfh-7hr2

medium2025-02-03

CVE-2025-24371-CometBFT allows a malicious peer to make node stuck in blocksync

cometbft/cometbft · GHSA-22qq-3xwm-r5x4

critical2025-02-03

CVE-2025-24370-Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass

adamghill/django-unicorn · GHSA-g9wf-5777-gq43

medium2025-02-03

CVE-2025-23210-PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters

phpoffice/phpspreadsheet · GHSA-r57h-547h-w24f