Security advisories

high2025-11-17

Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register)

flowiseai/flowise · GHSA-v5w9-prxf-w882

medium2025-11-17

CVE-2025-64758-@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message

dependencytrack/frontend · GHSA-7xvh-c266-cfr5

high2025-11-17

CVE-2025-64756-glob CLI: Command injection via -c/--cmd executes matches with shell:true

isaacs/node-glob · GHSA-5j98-mcp5-4vw2

high2025-11-17

CVE-2025-62519-phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality

thorsten/phpmyfaq · GHSA-fxm2-cmwj-qvx4

high2025-11-17

CVE-2025-65073-OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

openstack/keystone · GHSA-hcqg-5g63-7j9h

medium2025-11-17

CVE-2025-13262-lsFusion Platform has a Path Traversal vulnerability

lsfusion/platform · GHSA-gwwr-j923-vq7r

medium2025-11-17

CVE-2025-13266-vlife-base has Path Traversal vulnerability

wwwlike/vlife · GHSA-cg6m-9276-qpjj

medium2025-11-17

CVE-2025-13265-lsFusion Server is vulnerable to Path Traversal through its unpackFile function

lsfusion/platform · GHSA-8wf8-frjg-xv74

medium2025-11-17

CVE-2025-13261-lsFusion Platform has a Path Traversal vulnerability

lsfusion/platform · GHSA-5jpg-2rj5-964c

high2025-11-14

CVE-2024-21635-Memos' Access Tokens Stay Valid after User Password Change

usememos/memos · GHSA-mr34-8733-grr2

critical2025-11-14

CVE-2025-55449-AstrBot is vulnerable to RCE with hard-coded JWT signing keys

astrbotdevs/astrbot · GHSA-4m32-cjv7-f425

high2025-11-14

Apollo Federation has Improper Enforcement of Access Control on Transitive Fields

apollographql/federation · GHSA-m8jr-fxqx-8xx6

medium2025-11-14

CVE-2025-64747-Directus is Vulnerable to Stored Cross-site Scripting

directus/directus · GHSA-vv2v-pw69-8crf

medium2025-11-14

CVE-2025-64746-Directus has Improper Permission Handling on Deleted Fields

directus/directus · GHSA-9x5g-62gj-wqf2

high2025-11-14

CVE-2025-64717-ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP

zitadel/zitadel · GHSA-j4g7-v4m4-77px

high2025-11-14

Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change

flowiseai/flowise · GHSA-fjh6-8679-9pch

high2025-11-14

Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)

flowiseai/flowise · GHSA-x39m-3393-3qp4

high2025-11-14

Flowise Fails to Invalidate Existing Sessions After Password Changes

flowiseai/flowise · GHSA-x7rp-qj2h-ghgw

medium2025-11-14

Shopware 6's password recovery link does not expire after email change

shopware/shopware · GHSA-2w46-vq8h-98vh

low2025-11-14

CVE-2025-64711-PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users

privatebin/privatebin · GHSA-r9x7-7ggj-fx9f