Security advisories

medium2025-12-01

CVE-2025-63520-FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update function

liufee/cms · GHSA-c2vx-rx6x-m9wj

low2025-12-01

CVE-2025-13804-NutzBoot vulnerable to information disclosure

nutzam/nutzboot · GHSA-qp56-qj59-hjf8

low2025-12-01

CVE-2025-13805-NutzBoot vulnerable to deserialization

nutzam/nutzboot · GHSA-fgmj-6h3v-4q56

medium2025-12-01

CVE-2025-13806-NutzBoot Incorrect Privilege Assignment vulnerability

nutzam/nutzboot · GHSA-53v5-9752-qq92

low2025-11-30

CVE-2025-13785-Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images

yungifez/skuul · GHSA-xmh7-35v2-fp6h

low2025-11-30

CVE-2025-13784-yungifez Skuul School Management System vulnerable to XSS via SVG

yungifez/skuul · GHSA-92x3-mfjp-j3h3

medium2025-11-30

CVE-2025-66420-Tryton sao allows XSS via an HTML attachment

tryton/sao · GHSA-xhgv-99mj-8m2x

high2025-11-30

CVE-2025-66423-trytond does not enforce access rights for the route of the HTML editor.

tryton/trytond · GHSA-p3p5-xrmv-4j6x

medium2025-11-30

CVE-2025-66422-trytond allows remote attackers to obtain sensitive trace-back (server setup) information

tryton/trytond · GHSA-jqfc-9q34-prhg

medium2025-11-30

CVE-2025-66421-Tryton sao allows XSS because it does not escape completion values

tryton/sao · GHSA-6qj9-2g9m-29x9

medium2025-11-30

CVE-2025-66424-trytond does not enforce access rights for data export

tryton/trytond · GHSA-2w93-qwpp-vgvj

high2025-11-28

CVE-2025-12183-LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS

yawkat/lz4-java · GHSA-vqf4-7m7x-wgfc

low2025-11-28

CVE-2025-66372-Mustangproject allows exfiltrating files via XXE attacks

zugferd/mustangproject · GHSA-x832-fpvj-r5ph

medium2025-11-28

CVE-2025-66371-Peppol-py is vulnerable to XXE attacks due to Saxon configuration

iterasdev/peppol-py · GHSA-24hm-wm2h-h8w7

critical2025-11-27

CVE-2025-12421-Mattermost fails to to verify the token used during code exchange

mattermost/mattermost · GHSA-mp6x-97xj-9x62

medium2025-11-27

CVE-2025-3261-ThingsBoard allows an authenticated user to upload malicious SVG images

thingsboard/thingsboard · GHSA-5p82-2q3r-wj3m

medium2025-11-27

CVE-2025-12559-Mattermost fails to sanitize team email addresses

mattermost/mattermost · GHSA-4g87-9x45-cx2h

critical2025-11-27

CVE-2025-12419-Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication

mattermost/mattermost · GHSA-3x39-62h4-f8j6

medium2025-11-27

CVE-2025-54057-Apache SkyWalking has a stored XSS vulnerability

apache/skywalking · GHSA-v6x2-4q87-rf82

low2025-11-27

CVE-2025-13742-pretix has Email Content Injection Through Maliciously Formatted Names

pretix/pretix · GHSA-2mm6-624x-fqrr