Security advisories

medium2025-10-23

CVE-2025-61413-Piranha CMS vulnerable to stored cross-site scripting (XSS)

piranhacms/piranha.core · GHSA-3qcp-9v8c-6jp7

high2025-10-23

CVE-2025-62713-Kottster app reinitialization can be re-triggered allowing command injection in development mode

kottster/kottster · GHSA-j3w7-9qc3-g96p

high2025-10-23

CVE-2025-59048-OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method

openbao/openbao-plugins · GHSA-jp7h-4f3c-9rc7

medium2025-10-23

CVE-2025-62256-Liferay Portal and DXP do not properly restrict access to OpenAPI

liferay/liferay-portal · GHSA-j82q-c85j-xw4w

medium2025-10-23

CVE-2025-12110-Keycloak does not invalidate offline sessions when the offline_access scope is removed

keycloak/keycloak · GHSA-895x-rfqp-jh5c

medium2025-10-23

CVE-2025-11429-Keycloak does not invalidate sessions when "Remember Me" is disabled

keycloak/keycloak · GHSA-64w3-5q9m-68xf

medium2025-10-23

CVE-2025-62401-Moodle has a time restriction bypass

moodle/moodle · GHSA-w29j-8phw-ffjf

high2025-10-23

CVE-2025-62399-Moodle vulnerable to brute-force password guesses

moodle/moodle · GHSA-m58f-9pvv-8mp2

medium2025-10-23

CVE-2025-62396-Moodle's error handling leads to sensitive information disclosure

moodle/moodle · GHSA-c5cj-xp43-qcc3

medium2025-10-23

CVE-2025-62400-Moodle exposed the names of hidden groups to users

moodle/moodle · GHSA-422v-w6c5-vq42

medium2025-10-23

CVE-2025-62398-Moodle does not properly enforce MFA

moodle/moodle · GHSA-25wf-7x6c-wmpf

medium2025-10-23

CVE-2025-62393-Moodle course access permissions are not properly checked in course_output_fragment_course_overview

moodle/moodle · GHSA-rjcm-7v2p-9265

medium2025-10-23

CVE-2025-62394-Moodle sends quiz-related messages to inactive/suspended users

moodle/moodle · GHSA-8fcv-4qp9-pg32

medium2025-10-23

CVE-2025-62820-Slack Nebula may accept arbitrary source IP addresses

slackhq/nebula · GHSA-x6fh-7qmf-69xh

high2025-10-22

binary_vec_io access memory out-of-bounds in binary_read_to_ref and binary_write_from_ref

10xgenomics/rust-toolbox · GHSA-wwxp-hxh6-8gf8

low2025-10-22

CVE-2025-62247-Liferay Portal and DXP are Missing Authorization in Collection Provider

liferay/liferay-portal · GHSA-cqwv-9xh5-25fg

medium2025-10-22

CVE-2025-62248-Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)

liferay/liferay-portal · GHSA-phjr-p9c5-hprx

medium2025-10-22

CVE-2025-62705-OpenBao and Vault Leak []byte Fields in Audit Logs

openbao/openbao · GHSA-rc54-2g2c-g36g

medium2025-10-22

CVE-2025-62710-Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl

sakaiproject/sakai · GHSA-gr7h-xw4f-wh86

medium2025-10-22

CVE-2025-62708-pypdf can exhaust RAM via manipulated LZWDecode streams

py-pdf/pypdf · GHSA-jfx9-29x2-rv3j