14 Pull requests merged by 12 people

• [GHSA-3mcp-9wr4-cjqf] Remote Code Execution (RCE) vulnerability in dropwizard-validation

  #5785 merged Jul 3, 2025

• [GHSA-xjrf-8x4f-43h4] Improper Neutralization of Input During Web Page Generation in Spring Framework

  #5786 merged Jul 3, 2025

• [GHSA-fj44-h6xw-896g] react-native-keys 0.7.11 is vulnerable to sensitive...

  #5788 merged Jul 2, 2025

• [GHSA-cqqj-4p63-rrmm] HTTP Request Smuggling in Netty

  #5784 merged Jul 2, 2025

• [GHSA-5h6x-m52p-23ph] Improper Certificate Validation in Apache Qpid Proton

  #5780 merged Jul 1, 2025

• [GHSA-gpqc-4pp7-5954] Authentication Bypass by CSRF Weakness

  #5783 merged Jul 1, 2025

• [GHSA-v6w3-2prq-h95f] Improper Input Validation in Jakarta Expression Language

  #5782 merged Jul 1, 2025

• [GHSA-m964-fjrh-xxq2] Deserialization of Untrusted Data vulnerability in Apache...

  #5772 merged Jun 30, 2025

• [GHSA-vv7r-c36w-3prj] Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

  #5764 merged Jun 30, 2025

• [GHSA-jc9r-qcgw-fxq9] A vulnerability was found in sparklemotion nokogiri up to...

  #5778 merged Jun 30, 2025

• [GHSA-48p4-8xcf-vxj5] urllib3 does not control redirects in browsers and Node.js

  #5776 merged Jun 30, 2025

• [GHSA-g93m-8x6h-g5gv] When using IPAuthenticationProvider in ZooKeeper Admin...

  #5775 merged Jun 30, 2025

• [GHSA-rvqx-wpfh-mfx7] Langflow Unauth RCE

  #5773 merged Jun 30, 2025

• [GHSA-vhxf-7vqr-mrjg] DOMPurify allows Cross-site Scripting (XSS)

  #5763 merged Jun 30, 2025

5 Pull requests opened by 4 people

• [GHSA-9fq2-x9r6-wfmf] Numpy Deserialization of Untrusted Data

  #5777 opened Jun 30, 2025

• [GHSA-m8p2-495h-ccmh] The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks

  #5791 opened Jul 5, 2025

• [GHSA-wx5j-54mm-rqqq] HTTP request smuggling in netty

  #5792 opened Jul 5, 2025

• [GHSA-26f8-x7cc-wqpc] Apache Kafka Connect vulnerable to Deserialization of Untrusted Data

  #5793 opened Jul 5, 2025

• Set critical severity

  #5794 opened Jul 6, 2025

8 Issues closed by 3 people

• ## Code Review

  #5789 closed Jul 4, 2025

• Clarification on Overlap Between GHSA-gpqc-4pp7-5954 and GHSA-26xx-m4q2-xhq8

  #5756 closed Jul 2, 2025

• Possible Inaccuracy in XXE Vulnerability: Advisory-[GHSA-jffq-528j-mp6c]

  #5767 closed Jul 2, 2025

• Incorrect Package Attribution in GHSA-7rvp-xqj7-rxf2

  #5787 closed Jul 2, 2025

• Maven advisories missing scala SBT suffixes in package names

  #5781 closed Jul 2, 2025

• Check out this app!

  #5771 closed Jun 30, 2025

• Review requested:

  #5770 closed Jun 30, 2025

• Data

  #5769 closed Jun 30, 2025

1 Issue opened by 1 person

• Advisory GHSA-p3xv-97g8-4wmj lists incorrect fixed version

  #5790 opened Jul 4, 2025

3 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Go: Supported ecosystem

  #5762 commented on Jun 30, 2025 • 0 new comments

• julia ecosystem support

  #1689 commented on Jul 1, 2025 • 0 new comments

• [GHSA-9pp5-9c7g-4r83] Spring Security authorization bypass for method security annotations on private methods

  #5747 commented on Jul 2, 2025 • 0 new comments