Security advisories

medium2025-10-30

CVE-2025-62402-Apache Airflow `/api/v2/dagReports` executes DAG Python in API

apache/airflow · GHSA-273c-4g26-4jpm

medium2025-10-30

CVE-2025-62257-Liferay Portal vulnerable to password enumeration

liferay/liferay-portal · GHSA-8hw3-ghwv-crfh

high2025-10-29

CVE-2025-64104-LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore

langchain-ai/langgraph · GHSA-7p73-8jqx-23r8

high2025-10-29

CVE-2025-64103-Zitadel May Bypass Second Authentication Factor

zitadel/zitadel · GHSA-cfjq-28r2-4jv5

high2025-10-29

CVE-2025-64102-Zitadel allows brute-forcing authentication factors

zitadel/zitadel · GHSA-xrw9-r35x-x878

high2025-10-29

CVE-2025-64101-ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection

zitadel/zitadel · GHSA-mwmh-7px9-4c23

medium2025-10-29

OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability

pixaranimationstudios/openusd · GHSA-grjp-54v3-c442

medium2025-10-29

uv allows ZIP payload obfuscation through parsing differentials

astral-sh/uv · GHSA-pqhf-p39g-3x64

medium2025-10-29

CVE-2025-64100-CKAN vulnerable to fixed session IDs

ckan/ckan · GHSA-2hvh-cw5c-8q8q

critical2025-10-29

CVE-2025-64095-DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

dnnsoftware/dnn.platform · GHSA-3m8r-w7xg-jqvw

medium2025-10-29

CVE-2025-64094-DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

dnnsoftware/dnn.platform · GHSA-hmvq-8p83-cq52

medium2025-10-29

CVE-2025-62802-DNN CKEditor Provider allows unauthenticated upload out-of-the-box

dnnsoftware/dnn.platform · GHSA-2374-6cvw-qmx6

high2025-10-29

CVE-2025-11200-MLflow Weak Password Requirements Authentication Bypass Vulnerability

mlflow/mlflow · GHSA-6xj8-rrqx-r4cv

high2025-10-29

CVE-2025-11201-MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

mlflow/mlflow · GHSA-5cvj-7rg6-jggj

high2025-10-29

CVE-2025-60542-TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update

typeorm/typeorm · GHSA-q2pj-6v73-8rgj

medium2025-10-29

CVE-2025-62801-FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

jlowin/fastmcp · GHSA-rj5c-58rq-j5g5

medium2025-10-29

CVE-2025-62800-FastMCP vulnerable to reflected XSS in client's callback page

jlowin/fastmcp · GHSA-mxxr-jv3v-6pgc

high2025-10-29

FastMCP Auth Integration Allows for Confused Deputy Account Takeover

jlowin/fastmcp · GHSA-c2jp-c369-7pvx

medium2025-10-29

CVE-2025-54384-CKAN vulnerable to stored XSS in resource description

ckan/ckan · GHSA-2r4h-8jxv-w2j8

medium2025-10-29

CVE-2025-64150-Jenkins Publish to Bitbucket Plugin is missing a permissions check

jenkinsci/publish-to-bitbucket-plugin · GHSA-wpr5-rc2j-99p2