Security advisories

low2025-01-08

CVE-2024-45033-Apache Airflow Fab Provider Insufficient Session Expiration vulnerability

apache/airflow · GHSA-8863-4qmg-fr45

high2025-01-07

PHP-Textile has persistent XSS vulnerability in image link handling

textile/php-textile · GHSA-95m2-chm4-mq7m

high2025-01-07

WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover

h44z/wg-portal · GHSA-2r2v-9pf8-6342

medium2025-01-07

CVE-2024-52813-matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity

matrix-org/matrix-rust-sdk · GHSA-r5vf-wf4h-82gg

high2025-01-06

CVE-2025-21620-fetch: Authorization headers not dropped when redirecting cross-origin

denoland/deno · GHSA-f27p-cmv8-xhm6

low2025-01-06

CVE-2024-35498-Grav Cross-site Scripting vulnerability

getgrav/grav · GHSA-m78c-qx99-mvw9

low2025-01-06

CVE-2024-46209-REDAXO CMS Cross-site Scripting vulnerability

redaxo/redaxo · GHSA-2p95-8xvm-2pjx

medium2025-01-06

CVE-2025-21617-Guzzle OAuth Subscriber has insufficient nonce entropy

guzzle/oauth-subscriber · GHSA-237r-r8m4-4q88

high2025-01-06

CVE-2025-21618-NiceGUI On Air authentication issue

zauberzeug/nicegui · GHSA-v6jv-p6r8-j78w

high2025-01-06

CVE-2025-21614-go-git clients vulnerable to DoS via maliciously crafted Git server replies

go-git/go-git · GHSA-r9px-m959-cxf4

critical2025-01-06

CVE-2025-21613-go-git has an Argument Injection via the URL field

go-git/go-git · GHSA-v725-9546-7q7m

high2025-01-06

CVE-2025-21612-Extension:TabberNeue vulnerable to Cross-site Scripting

starcitizentools/mediawiki-extensions-tabberneue · GHSA-4x6x-8rm8-c37j

medium2025-01-03

CVE-2024-56332-Next.js Allows a Denial of Service (DoS) with Server Actions

vercel/next.js · GHSA-7m27-7ghc-44w9

medium2025-01-03

CVE-2024-56412-PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters

phpoffice/phpspreadsheet · GHSA-q9jv-mm3r-j47r

medium2025-01-03

CVE-2024-56411-PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header

phpoffice/phpspreadsheet · GHSA-hwcp-2h35-p66w

medium2025-01-03

CVE-2024-56410-PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties

phpoffice/phpspreadsheet · GHSA-wv23-996v-q229

high2025-01-03

CVE-2024-56409-PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file

phpoffice/phpspreadsheet · GHSA-j2xg-cjcx-4677

high2025-01-03

CVE-2024-56366-PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file

phpoffice/phpspreadsheet · GHSA-c6fv-7vh8-2rhr

high2025-01-03

CVE-2024-56365-PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class

phpoffice/phpspreadsheet · GHSA-jmpx-686v-c3wx

medium2025-01-03

CVE-2025-21610-Trix allows Cross-site Scripting via `javascript:` url in a link

basecamp/trix · GHSA-j386-3444-qgwg