Security advisories

medium2025-12-02

CVE-2025-66303-Grav is vulnerable to a DOS on the admin panel

getgrav/grav · GHSA-x62q-p736-3997

high2025-12-02

CVE-2025-66301-Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions

getgrav/grav · GHSA-v8x2-fjv7-8hjh

high2025-12-02

CVE-2025-66300-Grav is vulnerable to Arbitrary File Read

getgrav/grav · GHSA-p4ww-mcp9-j6f2

high2025-12-02

CVE-2025-66299-Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)

getgrav/grav · GHSA-gjc5-8cfh-653x

high2025-12-02

CVE-2025-66296-Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover

getgrav/grav · GHSA-cjcp-qxvg-4rjm

medium2025-12-02

CVE-2025-11538-Keycloak has debug default bind address

keycloak/keycloak · GHSA-j4vq-q93m-4683

medium2025-12-02

CVE-2025-65622-Snipe-IT allows stored XSS via the Locations "Country" field

grokability/snipe-it · GHSA-4g25-wj72-chxg

low2025-12-02

maxminddb's `Reader::open_mmap` unsoundly marks unsafe memmap operation as safe

oschwald/maxminddb-rust · GHSA-mj73-j457-8x9q

medium2025-12-02

CVE-2025-66221-Werkzeug safe_join() allows Windows special device names

pallets/werkzeug · GHSA-hgf8-39gv-g3f2

medium2025-12-01

CVE-2025-12756-Mattermost fails to validate user permissions when deleting comments in Boards

mattermost/mattermost · GHSA-p6gj-jc38-x2m7

medium2025-12-01

CVE-2025-65621-Snipe-IT is vulnerable to stored cross-site scripting

grokability/snipe-it · GHSA-fww5-m9wc-jcjc

high2025-12-01

CVE-2025-71401-Better Auth affected by external request basePath modification DoS

better-auth/better-auth · GHSA-569q-mpph-wgww

high2025-12-01

CVE-2025-14874-Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls

nodemailer/nodemailer · GHSA-rcmh-qjqh-p98v

low2025-12-01

CVE-2025-66040-Spotipy has a XSS vulnerability in its OAuth callback server

spotipy-dev/spotipy · GHSA-r77h-rpp9-w2xm

medium2025-12-01

CVE-2025-66034-fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

fonttools/fonttools · GHSA-768j-98cg-p3fv

medium2025-12-01

CVE-2025-64715-Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

cilium/cilium · GHSA-38pp-6gcp-rqvm

high2025-12-01

CVE-2025-55749-XWiki Jetty Package (XJetty) allows accessing any application file through URL

xwiki/xwiki-platform · GHSA-53gx-j3p6-2rw9

high2025-12-01

CVE-2025-64775-Apache Struts is Vulnerable to DoS via File Leak

apache/struts · GHSA-xx7v-hqxh-cjr9

medium2025-12-01

CVE-2025-63522-FeehiCMS is vulnerable to reverse tabnabbing

liufee/cms · GHSA-w756-rf26-7rmr

medium2025-12-01

CVE-2025-63523-FeehiCMS fails to enforce server-side immutability

liufee/cms · GHSA-qgc9-p7cj-jvh6