Security advisories

medium2025-10-16

CVE-2025-11842-Smidge is vulnerable to Path Traversal

shazwazza/smidge · GHSA-9rvm-p3qm-f4vv

high2025-10-16

CVE-2024-56143-Strapi Allows Unauthorized Access to Private Fields via parms.lookup

strapi/strapi · GHSA-495j-h493-42q2

medium2025-10-16

CVE-2025-62415-bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML)

bagisto/bagisto · GHSA-67px-r26w-598x

medium2025-10-16

CVE-2025-62411-LibreNMS has a Stored XSS vulnerability in its Alert Transport name field

librenms/librenms · GHSA-frc6-pwgr-c28w

high2025-10-16

CVE-2025-41253-Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection

spring-cloud/spring-cloud-gateway · GHSA-fwxx-wv44-7qfg

medium2025-10-16

CVE-2025-41254-Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages

spring-projects/spring-framework · GHSA-7fch-4f2f-jcgm

medium2025-10-16

CVE-2025-3930-Strapi is vulnerable to Insufficient Session Expiration

strapi/strapi · GHSA-4r8w-3jww-m2rp

low2025-10-16

CVE-2025-61581-Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability

apache/trafficcontrol · GHSA-9m49-p2j3-c6xm

low2025-10-16

CVE-2025-54499-Mattermost has an Observable Timing Discrepancy vulnerability

mattermost/mattermost · GHSA-xr3w-rmvj-f6m7

high2025-10-16

CVE-2025-58075-Mattermost has a Missing Authorization vulnerability

mattermost/mattermost · GHSA-r6qj-894f-5hr2

medium2025-10-16

CVE-2025-41443-Mattermost has a Missing Authorization vulnerability

mattermost/mattermost · GHSA-7cr3-38jm-6p45

high2025-10-16

CVE-2025-58073-Mattermost has a Missing Authorization vulnerability

mattermost/mattermost · GHSA-6q7m-p8cc-998r

critical2025-10-16

CVE-2025-54539-Apache ActiveMQ NMS AMQP Client has a Deserialization of Untrusted Data vulnerability

apache/activemq-nms-amqp · GHSA-4mjw-xr5x-prpc

low2025-10-16

CVE-2025-10545-Mattermost has an Incorrect Authorization vulnerability

mattermost/mattermost · GHSA-424h-xj87-m937

medium2025-10-16

CVE-2025-41410-Mattermost has a Missing Authorization vulnerability

mattermost/mattermost · GHSA-3q4q-wqm6-hvf3

medium2025-10-15

GeoIP processor disables SSL certificate validation when downloading databases

opensearch-project/data-prepper · GHSA-3xgr-h5hq-7299

medium2025-10-15

OpenSearch Data Prepper uses deprecated SSL protocol identifier

opensearch-project/data-prepper · GHSA-28gg-8qqj-fhh5

critical2025-10-15

CVE-2025-62410-happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript

capricorn86/happy-dom · GHSA-qpm2-6cq5-7pq5

medium2025-10-15

CVE-2025-62375-go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents

in-toto/go-witness · GHSA-72c7-4g63-hpw5

high2025-10-15

CVE-2025-62371-OpenSearch Data Prepper plugins trust all SSL certificates by default

opensearch-project/data-prepper · GHSA-43ff-rr26-8hx4