Security advisories

high2025-12-12

CVE-2025-8083-Vuetify has a Prototype Pollution vulnerability

vuetifyjs/vuetify · GHSA-3jp5-5f8r-q2wg

high2025-12-12

CVE-2025-3586-Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations

liferay/liferay-portal · GHSA-m5gv-vj3f-6v2p

high2025-12-12

CVE-2025-67750-Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule

flow-scanner/lightning-flow-scanner · GHSA-55jh-84jv-8mx8

high2025-12-12

Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration

babylonlabs-io/finality-provider · GHSA-4jmp-x7mh-rgmr

high2025-12-12

CVE-2025-66001-NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)

neuvector/neuvector · GHSA-4jj9-cgqc-x9h5

critical2025-12-12

CVE-2025-65854-MineAdmin has an insecure default password

mineadmin/mineadmin · GHSA-x6mh-4w8x-p34v

high2025-12-12

CVE-2025-67819-Weaviate OSS has path traversal vulnerability via the Shard Movement API

weaviate/weaviate · GHSA-hmmh-292h-3364

high2025-12-12

CVE-2025-67818-Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip

weaviate/weaviate · GHSA-7v39-2hx7-7c43

high2025-12-12

CVE-2025-53960-Apache StreamPark: Use the user’s password as the secret key Vulnerability

apache/streampark · GHSA-3hg2-rh4r-8qf6

high2025-12-12

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

vercel/next.js · GHSA-5j59-xgg2-r9c4

medium2025-12-12

Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components

vitejs/vite-plugin-react · GHSA-c6m7-q6pr-c64r

high2025-12-12

Vite Plugin React has a Denial of Service Vulnerability in React Server Components

vitejs/vite-plugin-react · GHSA-cpqf-f22c-r95x

high2025-12-12

CVE-2025-67779-Denial of Service Vulnerability in React Server Components

facebook/react · GHSA-7gmr-mq3h-m5h9

high2025-12-12

CVE-2025-54981-Apache StreamPark uses a Weak Encryption Algorithm

apache/streampark · GHSA-749j-2hp6-8cxm

high2025-12-12

CVE-2025-54947-Apache StreamPark has a hard-coded encryption key

apache/streampark · GHSA-prv5-c2px-j9q3

high2025-12-12

CVE-2025-26866-Apache HugeGraph-Server: RAFT and deserialization vulnerability

apache/incubator-hugegraph · GHSA-q37j-3367-fwv7

high2025-12-12

CVE-2024-58303-FoF Pretty Mail has a server-side template injection vulnerability

friendsofflarum/pretty-mail · GHSA-947q-2xw3-gx9c

medium2025-12-11

Next Server Actions Source Code Exposure

vercel/next.js · GHSA-w37m-7fhw-fmv9

high2025-12-11

Next Vulnerable to Denial of Service with Server Components

vercel/next.js · GHSA-mwv6-3258-q52c

high2025-12-11

CVE-2025-55184-Denial of Service Vulnerability in React Server Components

facebook/react · GHSA-2m3v-v2m8-q956