Security advisories

high2025-01-03

CVE-2025-21609-SiYuan has an arbitrary file deletion vulnerability

siyuan-note/siyuan · GHSA-8fx8-pffw-w498

medium2025-01-03

CVE-2024-56514-Karmada Tar Slips in CRDs archive extraction

karmada-io/karmada · GHSA-cwrh-575j-8vr3

high2025-01-03

CVE-2024-56513-Karmada PULL Mode Cluster Privilege Escalation

karmada-io/karmada · GHSA-mg7w-c9x2-xh7r

high2025-01-03

CVE-2024-56408-PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file

phpoffice/phpspreadsheet · GHSA-x88g-h956-m5xg

medium2025-01-02

CVE-2024-56199-phpMyFAQ Vulnerable to Stored HTML Injection at FAQ

thorsten/phpmyfaq · GHSA-ww33-jppq-qfrp

medium2025-01-02

CVE-2024-8447-Narayana deadlock via multiple join requests sent to LRA Coordinator

jbosstm/narayana · GHSA-qq9f-q439-2574

critical2025-01-02

CVE-2024-56198-path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability

cabraviva/path-sanitizer · GHSA-94p5-r7cc-3rpr

medium2025-01-02

CVE-2024-11184-The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded

mwdelaney/wp-enable-svg · GHSA-j77f-79w9-rghc

high2024-12-31

CVE-2024-25133-OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation

openshift/hive · GHSA-wgqq-9qh8-wvqv

low2024-12-30

magic-crypt uses insecure cryptographic algorithms

magiclen/rust-magiccrypt · GHSA-gmx7-gr5q-85w5

low2024-12-30

xous has unsound usages of `core::slice::from_raw_parts`

betrusted-io/xous-core · GHSA-gv7f-5qqh-vxfx

medium2024-12-30

CVE-2024-56517-LGSL has a reflected XSS at /lgsl_files/lgsl_list.php

tltneon/lgsl · GHSA-ggwq-xc72-33r3

high2024-12-30

CVE-2024-56734-Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

better-auth/better-auth · GHSA-8jhw-6pjj-8723

medium2024-12-30

CVE-2024-56733-Password Pusher Allows Session Token Interception Leading to Potential Hijacking

pglombardo/passwordpusher · GHSA-4fwj-m62q-pp47

medium2024-12-30

CVE-2024-52294-khoj has an IDOR in subscription management allows unauthorized subscription modifications

khoj-ai/khoj · GHSA-hq4h-w933-jm6c

critical2024-12-30

CVE-2024-50703-TeamPass privileges issue

nilsteampassnet/teampass · GHSA-9wmc-988h-2mv2

medium2024-12-30

CVE-2024-50702-TeamPass mail_me operation authorization issue

nilsteampassnet/teampass · GHSA-7rm3-4w6j-8xx4

medium2024-12-30

CVE-2024-50701-TeamPass does not properly check whether a folder is in a user's allowed folders list

nilsteampassnet/teampass · GHSA-2697-96mv-3gfm

low2024-12-28

CVE-2024-56512-Apache NiFi: Missing Complete Authorization for Parameter and Service References

apache/nifi · GHSA-mpj7-7mg7-x95j

medium2024-12-28

CVE-2024-54774-Dcat Admin Cross-site Scripting (XSS) vulnerability

jqhph/dcat-admin · GHSA-9q34-7hfr-h8jm