Security advisories

high2025-11-03

CVE-2025-47776-MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling

mantisbt/mantisbt · GHSA-4v8w-gg5j-ph37

medium2025-11-01

CVE-2025-62275-Liferay Portal and DXP do not check permissions of images in a blog entry

liferay/liferay-portal · GHSA-xf7m-v66q-76w8

medium2025-11-01

CVE-2025-62276-Liferay Portal and DXP use an incorrect cache-control header

liferay/liferay-portal · GHSA-6533-fhr2-f38h

medium2025-10-31

CVE-2025-62267-Liferay Portal and DXP affected by multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page

liferay/liferay-portal · GHSA-q285-wfpg-93hr

high2025-10-31

CVE-2025-64168-Agno session state overwrites between different sessions/users

agno-agi/agno · GHSA-vw84-hprm-cxmm

medium2025-10-31

CVE-2025-62264-Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter

liferay/liferay-portal · GHSA-2j97-4jmq-c4xf

medium2025-10-31

CVE-2020-25635-Ansible does not collect garbage after playbook run

ansible/ansible · GHSA-f556-49jc-4rvc

medium2025-10-31

CVE-2025-63675-cryptidy allows code execution via untrusted data due to pickle.loads

netinvent/cryptidy · GHSA-97w9-v595-3h5q

high2025-10-31

CVE-2025-6176-Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

google/brotli · GHSA-2qfp-q593-8484

high2025-10-30

CVE-2025-61141-sqls-server/sqls is vulnerable to command injection in the config command

sqls-server/sqls · GHSA-f9f4-5859-29mf

medium2025-10-30

CVE-2025-62265-Liferay Portal is vulnerable to XSS in the Blogs widget

liferay/liferay-portal · GHSA-56jv-4ww3-65mw

medium2025-10-30

CVE-2025-62266-Liferay Portal is vulnerable to DNS rebinding attacks

liferay/liferay-portal · GHSA-f5vh-4rj2-w8r8

high2025-10-30

CVE-2025-64112-Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation

statamic/cms · GHSA-g59r-24g3-h7cm

medium2025-10-30

CVE-2025-64118-node-tar has a race condition leading to uninitialized memory exposure

isaacs/node-tar · GHSA-29xp-372q-xqph

high2025-10-30

gnark-crypto allows unchecked memory allocation during vector deserialization

consensys/gnark-crypto · GHSA-fj2x-735w-74vq

medium2025-10-30

CVE-2025-64716-Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode

techarohq/anubis · GHSA-cf57-c578-7jvv

high2025-10-30

CVE-2025-62726-n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook

n8n-io/n8n · GHSA-xgp7-7qjq-vg47

low2025-10-30

CVE-2025-50736-Byaidu PDFMathTranslate vulnerable to open redirect

byaidu/pdfmathtranslate · GHSA-pfrv-63w8-q7rq

medium2025-10-30

CVE-2025-54941-Apache Airflow has a command injection vulnerability in "example_dag_decorator"

apache/airflow · GHSA-v3c9-j6h9-66v4

medium2025-10-30

CVE-2025-62503-Apache Airflow's create action can upsert existing Pools/Connections/Variables

apache/airflow · GHSA-gp5f-cx7h-8q6f