Weblate has improper validation upon invitation acceptance

GHSA-m6hq-f4w9-qrjj CVE-2025-64725 LOW about 6 hours ago

### Impact It was possible to accept an invitation opened by a different Weblate user. ### Patches * https://github.com/WeblateOrg/weblate/pull/...

pypi

No PRs yet

AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE

GHSA-9449-rphm-mjqr CVE-2025-67737 LOW 4 days ago

An API endpoint that is intended for internal use by the SFTP software `sftpgo` was mistakenly exposed to the public-facing HTTP API for AzuraCast ...

packagist

No PRs yet

Improper Validation of Query Parameters in Auth0 Next.js SDK

GHSA-mr6f-h57v-rpj5 CVE-2025-67716 LOW 5 days ago

### Description An input-validation flaw in the returnTo parameter in the Auth0 Next.js SDK could allow attackers to inject unintended OAuth query ...

npm

No PRs yet

Jenkins has a CSRF vulnerability on the login form

GHSA-6837-qgrc-x5p6 CVE-2025-67639 LOW 5 days ago

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into loggin...

maven

No PRs yet

Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions

GHSA-6q37-7866-h27j CVE-2025-14082 LOW 6 days ago

A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role m...

maven

No PRs yet

@tiptap/extension-link vulnerable to Cross-site Scripting (XSS)

GHSA-vhrc-hgrq-x75r CVE-2025-14284 LOW 6 days ago

Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in ...

npm

No PRs yet

matrix-sdk-base denial of service via custom m.room.join_rules event values

GHSA-jj6p-3m75-g2p3 CVE-2025-66622 LOW 7 days ago

The matrix-sdk-base crate is unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be explo...

cargo

No PRs yet

Envoy forwards early CONNECT data in TCP proxy mode

GHSA-rj35-4m94-77jh CVE-2025-64763 LOW 10 days ago

## Summary Forwarding of early CONNECT data in TCP proxy mode. ## Details Per [RFC 7231-4.3.6](https://www.rfc-editor.org/rfc/rfc7231#section-4....

go

No PRs yet

open-webui is Vulnerable to Incorrect Access Control

GHSA-frv8-gffc-37px CVE-2025-63681 LOW 11 days ago

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user o...

pypi

No PRs yet

Anthropic Sandbox Runtime Incorrectly Implemented Network Sandboxing

GHSA-9gqj-5w7c-vx47 CVE-2025-66479 LOW 11 days ago

Due to a bug in sandboxing logic, `sandbox-runtime` did not properly enforce a network sandbox if the sandbox policy did not configure any allowed ...

npm

No PRs yet

alexusmai laravel-file-manager is vulnerable to Directory Traversal

GHSA-rr44-8j7r-jg2q CVE-2025-65345 LOW 12 days ago

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create a...

packagist

No PRs yet

Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function

GHSA-3w8q-xq97-5j7x CVE-2025-66453 LOW 12 days ago

When an application passed an attacker controlled float poing number into the `toFixed()` function, it might lead to high CPU consumption and a pot...

maven

No PRs yet

Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

GHSA-pc5g-j9j7-p4q3 CVE-2025-65858 LOW 13 days ago

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field ...

pypi

No PRs yet

Mattermost fails to validate user permissions in Boards

GHSA-58w6-w55x-6wq8 CVE-2025-13870 LOW 14 days ago

Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the bloc...

go

No PRs yet

Keycloak unable to restrict access to the admin console

GHSA-vjr8-56p3-fmqq CVE-2025-10939 LOW 14 days ago

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The...

maven

No PRs yet

maxminddb's `Reader::open_mmap` unsoundly marks unsafe memmap operation as safe

GHSA-mj73-j457-8x9q LOW 14 days ago

maxminddb prior to version 0.27 declared `Reader::open_mmap` as safe despite wrapping an inherently unsafe memmap2 operation with no extra step don...

cargo

No PRs yet

rtvm-interpreter lacks sufficient checks in public API

GHSA-pq5v-rwp8-p7gm LOW 14 days ago

The affected function is unsound due to insufficient checks on public struct field.

cargo

No PRs yet

Better Auth affected by external request basePath modification DoS

GHSA-569q-mpph-wgww LOW 14 days ago

# Summary Affected versions of Better Auth allow an external request to configure `baseURL` when it isn’t defined through any other means. This ca...

npm

No PRs yet

Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls

GHSA-rcmh-qjqh-p98v LOW 14 days ago

### Summary A DoS can occur that immediately halts the system due to the use of an unsafe function. ### Details According to **RFC 5322**, nested ...

npm

No PRs yet

Spotipy has a XSS vulnerability in its OAuth callback server

GHSA-r77h-rpp9-w2xm CVE-2025-66040 LOW 14 days ago

### Summary XSS vulnerability in OAuth callback server allows JavaScript injection through unsanitized error parameter. Attackers can execute arbit...

pypi

2

Dependabot PRs

NutzBoot vulnerable to information disclosure

GHSA-qp56-qj59-hjf8 CVE-2025-13804 LOW 15 days ago

A security flaw has been discovered in nutzam NutzBoot up to 2.6.0-SNAPSHOT. The impacted element is an unknown function of the file nutzboot-demo/...

maven

No PRs yet

NutzBoot vulnerable to deserialization

GHSA-fgmj-6h3v-4q56 CVE-2025-13805 LOW 15 days ago

A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-li...

maven

No PRs yet

Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images

GHSA-xmh7-35v2-fp6h CVE-2025-13785 LOW 16 days ago

A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of th...

packagist

No PRs yet

yungifez Skuul School Management System vulnerable to XSS via SVG

GHSA-92x3-mfjp-j3h3 CVE-2025-13784 LOW 16 days ago

A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboa...

packagist

No PRs yet

Mustangproject allows exfiltrating files via XXE attacks

GHSA-x832-fpvj-r5ph CVE-2025-66372 LOW 18 days ago

Mustang before 2.16.3 allows exfiltrating files via XXE attacks.

maven

No PRs yet

Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions

GHSA-wmjr-v86c-m9jj LOW 19 days ago

### Summary A vulnerability was identified in the multi-session plugin for Better Auth, specifically in the /sign-out after-hook. The hook trusts ...

npm

No PRs yet

Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control

GHSA-gq25-78jf-v78c CVE-2025-65681 LOW 19 days ago

An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive...

pypi

No PRs yet

Contao is vulnerable to cross-site scripting in templates

GHSA-68q5-78xp-cwwc CVE-2025-65961 LOW 20 days ago

### Impact It is possible to inject code into the template output that will be executed in the browser in the front end and back end. ### Patches...

packagist

No PRs yet

VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM

GHSA-66jq-2c23-2xh5 CVE-2025-65942 LOW 20 days ago

### Impact Affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malforme...

go

No PRs yet

OMERO.web uses jquery-form library, which may be vulnerable to XSS attack

GHSA-j4gv-6x9v-v23g LOW 21 days ago

### Impact OMERO.web uses the jquery-form library throughout to handle form submission and response processing. Due to some unpatched potential vul...

pypi

No PRs yet

SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results

GHSA-9m7r-g8hg-x3vr CVE-2025-65111 LOW 24 days ago

### Impact If a schema includes the following characteristics: 1. Permission defined in terms of a union (`+`) 1. That union references the same ...

go

No PRs yet

OSV-SCALIBR has NULL Pointer Dereference

GHSA-f786-75f3-74xj CVE-2025-13425 LOW 25 days ago

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for ...

go

No PRs yet

Resty has a Path Traversal vulnerability

GHSA-cv3m-hxpc-4hvm CVE-2025-13435 LOW 25 days ago

A security vulnerability has been detected in Dreampie Resty versions up to the 1.3.1.SNAPSHOT. This affects the function Request of the file /rest...

maven

No PRs yet

phppgadmin vulnerable to Cross-site Scripting

GHSA-h369-cpjj-qfff CVE-2025-60796 LOW 25 days ago

phpPgAdmin versions 7.13.0 and earlier contain multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied inputs ...

packagist

No PRs yet

Astro Development Server has Arbitrary Local File Read

GHSA-x3h8-62x9-952g CVE-2025-64757 LOW 26 days ago

### Summary A vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through th...

npm

No PRs yet

Drupal core allows Content Spoofing

GHSA-h89p-5896-f4q8 CVE-2025-13082 LOW 27 days ago

User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupa...

packagist

No PRs yet

Drupal core allows Forceful Browsing

GHSA-83v7-c2cf-p9c2 CVE-2025-13080 LOW 27 days ago

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core: ...

packagist

No PRs yet

Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels

GHSA-mhpg-hpj5-73r2 CVE-2025-13083 LOW 27 days ago

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Contr...

packagist

No PRs yet

Mattermost allows other users to determine when users had read channels via channel member objects

GHSA-9hh7-6558-qfp2 CVE-2025-55074 LOW 27 days ago

Mattermost versions 10.11.x <= 10.11.3, and 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to d...

go

No PRs yet

Drupal Simple multi step form allows Cross-Site Scripting

GHSA-gg35-374m-9ph8 CVE-2025-12761 LOW 27 days ago

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Si...

packagist

No PRs yet

LibreNMS has Weak Password Policy

GHSA-5mrf-j8v6-f45g CVE-2025-65014 LOW 27 days ago

## Summary A **Weak Password Policy** vulnerability was identified in the user management functionality of the _LibreNMS_ application. This vulner...

packagist

No PRs yet

PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users

GHSA-r9x7-7ggj-fx9f CVE-2025-64711 LOW about 1 month ago

## Summary Dragging a file whose filename contains HTML is reflected verbatim into the page via the drag-and-drop helper, so any user who drops a ...

packagist

No PRs yet

Mattermost allows regular users to access archived channel content and files

GHSA-x3hx-ch7p-8xgg CVE-2025-41436 LOW about 1 month ago

Mattermost versions < 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archiv...

go

No PRs yet

SpiceDB WriteRelationships fails silently if payload is too big

GHSA-pm3x-jrhh-qcr7 CVE-2025-64529 LOW about 1 month ago

### Impact Users who: 1. Use the exclusion operator somewhere in their authorization schema. 1. Have configured their SpiceDB server such that `--...

go

No PRs yet

Astro development server error page is vulnerable to reflected Cross-site Scripting

GHSA-w2vj-39qv-7vh7 CVE-2025-64745 LOW about 1 month ago

## Summary A Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configur...

npm

No PRs yet

Mattermost Incorrect Authorization vulnerability

GHSA-mqcj-8c2g-h97q CVE-2025-11777 LOW about 1 month ago

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, whic...

go

No PRs yet

Wasmtime provides unsound API access to a WebAssembly shared linear memory

GHSA-hc7m-r6v8-hg9q CVE-2025-64345 LOW about 1 month ago

### Impact Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which p...

cargo

4

Dependabot PRs

sudo-rs: Partial password reveal is possible after timeout

GHSA-c978-wq47-pvvw CVE-2025-64170 LOW about 1 month ago

### Summary If a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens,...

cargo

No PRs yet

changedetection.io: Stored XSS in Watch update via API

GHSA-4c3j-3h7v-22q9 CVE-2025-62780 LOW about 1 month ago

### Summary A Stored Cross Site Scripting is present in the changedetection.io Watch update API due to unsufficient security checks. ### Details ...

pypi

No PRs yet

EverShop is vulnerable to Unauthorized Order Information Access (IDOR)

GHSA-c73g-mx2w-cc93 CVE-2025-12919 LOW about 1 month ago

A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolv...

npm

No PRs yet