GHSA-CJ62-HVV2-2Q5H Ghost: Database Backup Path Traversal

Impact An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues. Vulnerable versions This vulnerability is present in Ghost from 1.20.1 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For...

Timing Side-Channel in Vault’s Userpass Auth Method

Summary A timing side channel in Vault and Vault Enterprise’s “Vault” userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s userpass auth method. This vulnerability, identified as CVE-2025-6011, is...