CVE-2025-47928 Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using pullrequesttarget on .github/workflows/integrationtests.yml followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be execute...

CVE-2025-47928 Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using pullrequesttarget on .github/workflows/integrationtests.yml followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be execute...

org.keycloak:keycloak-dependencies-server-all (20.0.0), org.keycloak:keycloak-guides (20.0.0) +6 more potentially affected by CVE-2025-0604 via org.keycloak:keycloak-ldap-federation (20.0.0)

org.keycloak:keycloak-ldap-federation MAVEN version 20.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 20.0.0 - org.keycloak:keycloak-guides...

org.keycloak:keycloak-dependencies-server-all (20.0.5), org.keycloak:keycloak-guides (20.0.5) +6 more potentially affected by CVE-2025-0604 via org.keycloak:keycloak-ldap-federation (20.0.5)

org.keycloak:keycloak-ldap-federation MAVEN version 20.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 20.0.5 - org.keycloak:keycloak-guides...

io.quarkiverse.operatorsdk:quarkus-operator-sdk-integration-tests (2.0.0.beta2), io.quarkiverse.operatorsdk:quarkus-operator-sdk-samples (2.0.0.beta2) +23 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (2.0.1.final)

io.quarkus:quarkus-resteasy MAVEN version 2.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk-integration-tests 2.0.0.beta2 -...

io.debezium:debezium-server (1.9.0.alpha1), io.debezium:debezium-server-core (1.9.0.alpha1) +181 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (2.6.2.final)

io.quarkus:quarkus-resteasy MAVEN version 2.6.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.debezium:debezium-server 1.9.0.alpha1 - io.debezium:debezium-server-core 1.9.0.alpha1 -...

io.quarkiverse.artemis:quarkus-artemis-integration-tests-parent (2.0.4), io.quarkiverse.artemis:quarkus-integration-test-artemis-camel-jms-common (2.0.4) +45 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (2.15.1.final)

io.quarkus:quarkus-resteasy MAVEN version 2.15.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkiverse.artemis:quarkus-artemis-integration-tests-parent 2.0.4 -...

com.expediagroup:beekeeper-integration-tests (>=3.0.3, <=3.6.7), com.hotels:beeju (4.0.0) +3 more potentially affected by CVE-2024-23953 via org.apache.hive:hive-llap-common (2.3.8)

org.apache.hive:hive-llap-common MAVEN version 2.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-llap-common and may be impacted: - com.expediagroup:beekeeper-integration-tests =3.0.3, =0.6.0, =0.6.1 Source cves: CVE-2024-23953...

org.keycloak:keycloak-guides (17.0.0), org.keycloak:keycloak-guides-maven-plugin (17.0.0) +3 more potentially affected by CVE-2024-11734 via org.keycloak:keycloak-quarkus-server (17.0.0)

org.keycloak:keycloak-quarkus-server MAVEN version 17.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 17.0.0 - org.keycloak:keycloak-guides-maven-plugin 17.0.0...

org.keycloak:keycloak-guides (17.0.1), org.keycloak:keycloak-guides-maven-plugin (17.0.1) +3 more potentially affected by CVE-2024-11734 via org.keycloak:keycloak-quarkus-server (17.0.1)

org.keycloak:keycloak-quarkus-server MAVEN version 17.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 17.0.1 - org.keycloak:keycloak-guides-maven-plugin 17.0.1...

org.keycloak:keycloak-guides (19.0.0), org.keycloak:keycloak-guides-maven-plugin (19.0.0) +3 more potentially affected by CVE-2024-11734 via org.keycloak:keycloak-quarkus-server (19.0.0)

org.keycloak:keycloak-quarkus-server MAVEN version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 19.0.0 - org.keycloak:keycloak-guides-maven-plugin 19.0.0...

org.keycloak:keycloak-guides (20.0.2), org.keycloak:keycloak-guides-maven-plugin (20.0.2) +3 more potentially affected by CVE-2024-11734 via org.keycloak:keycloak-quarkus-server (20.0.2)

org.keycloak:keycloak-quarkus-server MAVEN version 20.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 20.0.2 - org.keycloak:keycloak-guides-maven-plugin 20.0.2...

org.keycloak:keycloak-guides (20.0.5), org.keycloak:keycloak-guides-maven-plugin (20.0.5) +3 more potentially affected by CVE-2024-11734 via org.keycloak:keycloak-quarkus-server (20.0.5)

org.keycloak:keycloak-quarkus-server MAVEN version 20.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 20.0.5 - org.keycloak:keycloak-guides-maven-plugin 20.0.5...

org.keycloak:keycloak-guides (21.0.2), org.keycloak:keycloak-guides-maven-plugin (21.0.2) +3 more potentially affected by CVE-2024-11734 via org.keycloak:keycloak-quarkus-server (21.0.2)

org.keycloak:keycloak-quarkus-server MAVEN version 21.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 21.0.2 - org.keycloak:keycloak-guides-maven-plugin 21.0.2...

org.keycloak:keycloak-guides (20.0.1), org.keycloak:keycloak-guides-maven-plugin (20.0.1) +3 more potentially affected by CVE-2024-11734 via org.keycloak:keycloak-quarkus-server (20.0.1)

org.keycloak:keycloak-quarkus-server MAVEN version 20.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 20.0.1 - org.keycloak:keycloak-guides-maven-plugin 20.0.1...

io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0, <=0.2.0), org.keycloak:keycloak-guides (21.0.1) +4 more potentially affected by CVE-2024-11734 via org.keycloak:keycloak-quarkus-server (21.0.1)

org.keycloak:keycloak-quarkus-server MAVEN version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics =0.1.0, =0.2.0 - org.keycloak:keycloak-guide...

org.keycloak:keycloak-guides (15.1.0), org.keycloak:keycloak-guides-maven-plugin (15.1.0) +3 more potentially affected by CVE-2024-11734 via org.keycloak:keycloak-quarkus-server (15.1.0)

org.keycloak:keycloak-quarkus-server MAVEN version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 15.1.0 - org.keycloak:keycloak-guides-maven-plugin 15.1.0...

org.keycloak:keycloak-guides (16.1.0), org.keycloak:keycloak-guides-maven-plugin (16.1.0) +3 more potentially affected by CVE-2024-11734 via org.keycloak:keycloak-quarkus-server (16.1.0)

org.keycloak:keycloak-quarkus-server MAVEN version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 16.1.0 - org.keycloak:keycloak-guides-maven-plugin 16.1.0...

org.keycloak:keycloak-guides (19.0.2), org.keycloak:keycloak-guides-maven-plugin (19.0.2) +3 more potentially affected by CVE-2024-11734 via org.keycloak:keycloak-quarkus-server (19.0.2)

org.keycloak:keycloak-quarkus-server MAVEN version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 19.0.2 - org.keycloak:keycloak-guides-maven-plugin 19.0.2...

org.keycloak:keycloak-guides (20.0.0), org.keycloak:keycloak-guides-maven-plugin (20.0.0) +3 more potentially affected by CVE-2024-11734 via org.keycloak:keycloak-quarkus-server (20.0.0)

org.keycloak:keycloak-quarkus-server MAVEN version 20.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 20.0.0 - org.keycloak:keycloak-guides-maven-plugin 20.0.0...