Security advisories

medium2025-10-21

CVE-2025-60790-ProcessWire CMS vulnerable to resource-exhaustion Denial of Service

processwire/processwire · GHSA-9p44-q66p-xm6p

medium2025-10-21

CVE-2025-62250-Liferay Portal fails to verify messages from the cluster network is trusted

liferay/liferay-portal · GHSA-6pgj-w687-9c8c

critical2025-10-21

Cosmos EVM Vulnerability

cosmos/evm · GHSA-8pfh-j44r-f654

medium2025-10-21

Shopware Customer Orders can be canceled, even if refunds are disabled

shopware/shopware · GHSA-r2vg-hvjm-fg38

medium2025-10-21

Shopware exposes sensitive user information via CSV export mapping

shopware/shopware · GHSA-27c9-vp3w-6ww8

low2025-10-21

Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice

shopware/shopware · GHSA-3cpp-fv95-mpr5

low2025-10-21

Shopware vulnerable to path traversal via Plugin upload

shopware/shopware · GHSA-6wh5-mw9h-5c3w

medium2025-10-21

Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually

shopware/shopware · GHSA-m895-2hj3-8cg9

high2025-10-21

CVE-2025-62518-astral-tokio-tar Vulnerable to PAX Header Desynchronization

astral-sh/tokio-tar · GHSA-j5gw-2vrg-8fgx

medium2025-10-21

CVE-2025-62595-Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic

koajs/koa · GHSA-g8mr-fgfg-5qpc

medium2025-10-20

CVE-2025-62528-Taguette vulnerable to cross-site scripting via tag name, tag description, document name and document description

remram44/taguette · GHSA-g9qw-g6rv-3889

high2025-10-20

CVE-2025-62527-Taguette password reset link poisoning

remram44/taguette · GHSA-7rc8-5c8q-jr6j

medium2025-10-20

Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read

louislam/uptime-kuma · GHSA-vffh-c9pq-4crh

medium2025-10-20

CVE-2025-62522-vite allows server.fs.deny bypass via backslash on Windows

vitejs/vite · GHSA-93m4-6634-74q7

critical2025-10-20

CVE-2025-10678-NetBird VPN does not remove the default password of an admin account

netbirdio/netbird · GHSA-g3j4-58mp-3x25

medium2025-10-20

Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

actualbudget/actual · GHSA-xvp7-8vm8-xfxx

low2025-10-20

CVE-2025-57325-rollbar vulnerable to prototype pollution

rollbar/rollbar.js · GHSA-r8c2-2qwq-94p6

medium2025-10-20

CVE-2025-62508-Citizen vulnerable to stored XSS in sticky header button messages

starcitizentools/mediawiki-skins-citizen · GHSA-g955-vw6w-v6pp

high2025-10-20

CVE-2025-57738-Apache Syncope allows malicious administrators to inject Groovy code

apache/syncope · GHSA-825g-mm5v-ggq4

low2025-10-20

CVE-2025-61417-TastyIgniter vulnerable to Cross-Site Scripting

tastyigniter/tastyigniter · GHSA-4vrf-42cm-7xfw