Security advisories

medium2025-10-17

ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text

ibexa/fieldtype-richtext · GHSA-8c2g-f8jm-5cr7

high2025-10-17

CVE-2025-48044-Ash has authorization bypass when bypass policy condition evaluates to true

ash-project/ash · GHSA-pcxq-fjp3-r752

medium2025-10-17

ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal

ibexa/admin-ui · GHSA-2mx6-fq24-g2mh

medium2025-10-17

ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal

ezsystems/ezplatform-admin-ui · GHSA-99c7-c3mw-mxhv

medium2025-10-17

ibexa/user login enumerates user accounts

ibexa/user · GHSA-q3x8-6898-23g3

low2025-10-17

CVE-2025-62505-Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module

lobehub/lobe-chat · GHSA-fgx4-p8xf-qhp9

medium2025-10-17

CVE-2025-10044-Keycloak error_description injection on error pages that can trigger phishing attacks

keycloak/keycloak · GHSA-27gc-wj6x-9w55

high2025-10-17

CVE-2025-59043-OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests

openbao/openbao · GHSA-g46h-2rq9-gw5m

high2025-10-17

CVE-2025-26625-Git LFS may write to arbitrary files via crafted symlinks

git-lfs/git-lfs · GHSA-6pvw-g552-53c5

medium2025-10-17

CVE-2025-11849-Mammoth is vulnerable to Directory Traversal

mwilliamson/java-mammoth · GHSA-rmjr-87wv-gf87

high2025-10-16

CVE-2025-62506-MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS

minio/minio · GHSA-jjjj-jwhf-8rgr

high2025-10-16

CVE-2025-62427-Angular SSR has a Server-Side Request Forgery (SSRF) flaw

angular/angular-cli · GHSA-q63q-pgmf-mxhr

medium2025-10-16

CVE-2025-62414-bagisto has Cross Site Scripting (XSS) in Create New Customer

bagisto/bagisto · GHSA-r9xj-mvqf-jm7w

critical2025-10-16

CVE-2025-62417-bagisto has CSV Formula Injection in Create New Product

bagisto/bagisto · GHSA-jqrp-58fv-w8cq

medium2025-10-16

CVE-2025-62418-bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)

bagisto/bagisto · GHSA-fg89-g389-p346

medium2025-10-16

CVE-2025-62416-bagisto has Server Side Template Injection (SSTI) in Product Description

bagisto/bagisto · GHSA-527q-4wqv-g9wj

low2025-10-16

CVE-2025-62412-LibreNMS alert-rules has a Cross-Site Scripting Vulnerability

librenms/librenms · GHSA-6g2v-66ch-6xmh

low2025-10-16

CVE-2025-61924-PrestaShop Checkout Target PayPal merchant account hijacking from backoffice

prestashopcorp/ps_checkout · GHSA-wvpg-4wrh-5889

medium2025-10-16

CVE-2025-61923-PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure

prestashopcorp/ps_checkout · GHSA-fpxp-pfqm-x54w

critical2025-10-16

CVE-2025-61922-PrestaShop Checkout allows customer account takeover via email

prestashopcorp/ps_checkout · GHSA-54hq-mf6h-48xh