Security advisories

high2025-10-15

CVE-2025-62381-`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`

ciscoheat/sveltekit-superforms · GHSA-hwmc-4c8j-xxj7

low2025-10-15

CVE-2025-62380-Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails

eladnava/mailgen · GHSA-q4w9-x3rv-4c8j

medium2025-10-15

CVE-2023-44273-gnark-crypto doesn't range check input values during ECDSA and EdDSA signature deserialization

consensys/gnark-crypto · GHSA-fr8m-434r-g3xp

low2025-10-15

CVE-2025-62379-reflex-dev/reflex has an Open Redirect vulnerability

reflex-dev/reflex · GHSA-rfh5-c9h5-q8jm

medium2025-10-15

CVE-2025-55248-Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability

dotnet/runtime · GHSA-gwq6-fmvp-qp68

high2025-10-15

CVE-2025-55247-Microsoft Security Advisory CVE-2025-55247 | .NET Denial of Service Vulnerability

dotnet/msbuild · GHSA-w3q9-fxm7-j8fq

high2025-10-15

CVE-2025-62370-alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing

alloy-rs/core · GHSA-pgp9-98jm-wwq2

high2025-10-15

CVE-2025-59419-Netty has SMTP Command Injection Vulnerability that Allows Email Forgery

netty/netty · GHSA-jq43-27x9-3v86

low2025-10-15

CVE-2025-55039-Apache Spark has Inadequate Encryption Strength

apache/spark · GHSA-6p6v-m64v-jx8q

medium2025-10-14

CVE-2025-62374-Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs

parse-community/parse-sdk-js · GHSA-9f2h-7v79-mxw3

medium2025-10-14

CVE-2025-54265-Magento allows incorrect authorization

magento/magento2 · GHSA-r355-75hw-r8jf

medium2025-10-14

CVE-2025-54267-Magento vulnerable to privilege escalation due to incorrect authorization

magento/magento2 · GHSA-qvwr-p3hj-j6jf

medium2025-10-14

CVE-2025-54266-Magento vulnerable to stored Cross-Site Scripting (XSS)

magento/magento2 · GHSA-pcrx-r49h-x2w5

high2025-10-14

CVE-2025-54263-Magento provides incorrect authorization through a security feature bypass

magento/magento2 · GHSA-69x9-xp2j-w8g8

high2025-10-14

CVE-2025-54264-Magento vulnerable to stored Cross-Site Scripting (XSS)

magento/magento2 · GHSA-2768-5wmv-cfff

high2025-10-14

CVE-2025-34267-Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages

flowiseai/flowise · GHSA-r4hh-pcgx-j5r2

critical2025-10-14

CVE-2025-55315-Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability

dotnet/aspnetcore · GHSA-5rrx-jjjq-q2r5

high2025-10-14

CometBFT's invalid BitArray handling can lead to network halt

cometbft/cometbft · GHSA-hrhf-2vcr-ghch

low2025-10-14

CVE-2025-62366-Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails

eladnava/mailgen · GHSA-xw6r-chmh-vpmj

high2025-10-14

CVE-2025-62172-Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name

home-assistant/core · GHSA-mq77-rv97-285m