Security advisories

high2025-10-11

CVE-2025-62162-cel-rust May Panic During Parsing of Invalid CEL Expressions

cel-rust/cel-rust · GHSA-wxwx-9fh7-5mrw

critical2025-10-10

CVE-2025-61927-Happy DOM: VM Context Escape can lead to Remote Code Execution

capricorn86/happy-dom · GHSA-37j7-fg3j-429f

high2025-10-10

Parallax is vulnerable to DoS via malicious p2p message

microstack-tech/parallax · GHSA-xc79-566c-j4qx

medium2025-10-10

CVE-2025-61925-Astro's `X-Forwarded-Host` is reflected without validation

withastro/astro · GHSA-5ff5-9fcw-vg88

high2025-10-10

Flowise is vulnerable to arbitrary file exposure through its ReadFileTool

flowiseai/flowise · GHSA-j44m-5v8f-gc9c

medium2025-10-10

CVE-2025-62706-Authlib : JWE zip=DEF decompression bomb enables DoS

authlib/authlib · GHSA-g7f3-828f-7h7m

medium2025-10-10

CVE-2025-61926-Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret

ossf/allstar · GHSA-33f4-mjch-7fpr

medium2025-10-10

CVE-2025-61912-python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination

python-ldap/python-ldap · GHSA-p34h-wq7j-h5v6

medium2025-10-10

CVE-2025-61911-python-ldap has sanitization bypass in ldap.filter.escape_filter_chars

python-ldap/python-ldap · GHSA-r7r6-cc7p-4v5m

medium2025-10-10

CVE-2025-62245-Liferay Portal is vulnerable to CSRF through publication comments

liferay/liferay-portal · GHSA-9676-rh83-cr86

medium2025-10-10

CVE-2025-11581-PowerJob OpenAPIController is missing authorization

powerjob/powerjob · GHSA-9wq6-87hw-6mhc

high2025-10-10

CVE-2025-60880-Bagisto is vulnerable to XSS through Admin Panel's product creation path

bagisto/bagisto · GHSA-29mf-w486-v3vc

low2025-10-10

CVE-2025-61921-Sinatra is vulnerable to ReDoS through ETag header value generation

sinatra/sinatra · GHSA-mr3q-g2mv-mr4q

high2025-10-10

CVE-2025-61920-Authlib is vulnerable to Denial of Service via Oversized JOSE Segments

authlib/authlib · GHSA-pq5p-34cr-23v9

medium2025-10-10

CVE-2025-11580- PowerJob has Missing Authorization in its /user/list file

powerjob/powerjob · GHSA-87xj-ghmc-c3xq

high2025-10-10

CVE-2025-61919-Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

rack/rack · GHSA-6xw4-3v39-52mm

medium2025-10-10

CVE-2025-61780-Rack has a Possible Information Disclosure Vulnerability

rack/rack · GHSA-r657-rxjc-j557

high2025-10-10

CVE-2025-59530-quic-go: Panic occurs when queuing undecryptable packets after handshake completion

quic-go/quic-go · GHSA-47m2-4cr7-mhcw

medium2025-10-10

CVE-2025-62238-Liferay Portal's Membership page is vulnerable to XSS through “name“ text field

liferay/liferay-portal · GHSA-xw6m-3m5q-mxpm

medium2025-10-10

CVE-2025-62239-Liferay Portal is vulnerable to XSS through its workflow process builder

liferay/liferay-portal · GHSA-xcvw-hh99-qm73