Security advisories

medium2025-01-21

CVE-2025-24013-Missing validation of header name and value in codeigniter4/framework

codeigniter4/codeigniter4 · GHSA-x5mq-jjr3-vmx6

medium2025-01-21

CVE-2025-22620-gix-worktree-state nonexclusive checkout sets executable files world-writable

gitoxidelabs/gitoxide · GHSA-fqmf-w4xh-33rh

medium2025-01-21

CVE-2025-22150-Use of Insufficiently Random Values in undici

nodejs/undici · GHSA-c76h-2ccp-4975

medium2025-01-21

CVE-2025-22131-Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet

phpoffice/phpspreadsheet · GHSA-79xx-vf93-p7cx

high2025-01-21

CVE-2024-41672-sniff_csv provides filesystem access even when enable_external_access is disabled in duckdb

duckdb/duckdb · GHSA-w2gf-jxc9-pf2q

high2025-01-21

CVE-2024-53829-Cross-Site Request Forgery in CodeChecker API

ericsson/codechecker · GHSA-f8c8-4pm7-w885

medium2025-01-21

CVE-2024-10846-Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop

compose-spec/compose-go · GHSA-36gq-35j3-p9r9

high2025-01-21

CVE-2025-24019-Authenticated arbitrary file deletion in YesWiki

yeswiki/yeswiki · GHSA-43c9-gw4x-pcx6

high2025-01-21

CVE-2025-24018-Authenticated Stored XSS in YesWiki

yeswiki/yeswiki · GHSA-w59h-3x3q-3p6j

high2025-01-21

CVE-2025-24017-Unauthenticated DOM Based XSS in YesWiki

yeswiki/yeswiki · GHSA-wphc-5f2j-jhvg

medium2025-01-21

CVE-2025-24012-XSS/HTML Injection Vulnerability in Umbraco Backoffice Components

umbraco/umbraco-cms · GHSA-wv8v-rmw2-25wc

medium2025-01-21

CVE-2025-23221-Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify

dahlia/fedify · GHSA-c59p-wq67-24wx

medium2025-01-21

CVE-2025-24010-Websites were able to send any requests to the development server and read the response in vite

vitejs/vite · GHSA-vg6x-rcgg-rjx6

high2025-01-21

CVE-2025-23209-Craft CMS has a potential RCE with a compromised security key

craftcms/cms · GHSA-x684-96hh-833x

medium2025-01-21

CVE-2024-43709-Elasticsearch allocation of resources without limits or throttling leads to crash

elastic/elasticsearch · GHSA-jgx4-7v3v-vwfm

high2025-01-21

CVE-2025-23184-Apache CXF: Denial of Service vulnerability with temporary files

apache/cxf · GHSA-fh5r-crhr-qrrq

high2025-01-20

CVE-2025-24337-Insecure default config access in WriteFreely

writefreely/writefreely · GHSA-3qc3-mx6x-267h

high2025-01-17

CVE-2025-23208-Zot IdP group membership revocation ignored

project-zot/zot · GHSA-c9p4-xwr9-rfhx

medium2025-01-17

CVE-2025-23207-KaTeX \htmlData does not validate attribute names

katex/katex · GHSA-cg87-wmx4-v546

low2025-01-17

CVE-2025-23206-AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider

aws/aws-cdk · GHSA-v4mq-x674-ff73