Security advisories

medium2025-10-10

CVE-2025-60868-Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw

alt-design/alt-redirect-addon · GHSA-rpjr-pcmr-9ppw

medium2025-10-10

CVE-2025-62237-Liferay Portal Commerce is vulnerable to XSS through account "name" field

liferay/com-liferay-commerce · GHSA-m4g9-5mg6-gfr3

medium2025-10-10

CVE-2025-11579-rardecode: DoS risk due to unrestricted RAR dictionary sizes

nwaples/rardecode · GHSA-rwvp-r38j-9rgg

high2025-10-10

CVE-2025-30001-Apache StreamPark contains an Incorrect Execution-Assigned Permissions vulnerability

apache/streampark · GHSA-6wwv-6mm3-pp76

medium2025-10-10

CVE-2025-37727-Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

elastic/elasticsearch · GHSA-56r7-h6mw-rcfv

low2025-10-10

CVE-2025-11570-drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS

drupal-pattern-lab/unified-twig-extensions · GHSA-64mv-9655-37hx

critical2025-10-09

CVE-2025-10283-BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE

blacklanternsecurity/bbot · GHSA-h6m2-r6h9-4c44

medium2025-10-09

CVE-2025-10281-BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver

blacklanternsecurity/bbot · GHSA-63wh-p5fx-h4vc

critical2025-10-09

CVE-2025-10284-BBOT's various issues in unarchive.py can cause arbitrary file write and RCE

blacklanternsecurity/bbot · GHSA-fhw8-8v9p-7jp7

high2025-10-09

CVE-2025-11573-Amazon.IonDotnet is vulnerable to Denial of Service attacks

amazon-ion/ion-dotnet · GHSA-q5r6-9qwq-g2wj

medium2025-10-09

CVE-2025-62240-Liferay Portal is vulnerable to XSS through its Calendar Events parameters

liferay/liferay-portal · GHSA-5264-m964-7pg9

medium2025-10-09

CVE-2025-61783-Python Social Auth - Django has unsafe account association

python-social-auth/social-app-django · GHSA-wv4w-6qv2-qqfg

high2025-10-09

CVE-2025-61928-Better Auth: Unauthenticated API key creation through api-key plugin

better-auth/better-auth · GHSA-99h5-pjcv-gr6v

medium2025-10-09

CVE-2025-62228-Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers

apache/flink-cdc · GHSA-wqm3-w3p6-xjgm

high2025-10-09

n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on Host

n8n-io/n8n · GHSA-365g-vjw2-grx8

critical2025-10-09

CVE-2025-61913-Flowise is vulnerable to arbitrary file write through its WriteFileTool

flowiseai/flowise · GHSA-jv9m-vf54-chjj

high2025-10-09

CVE-2025-61773-pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters

pyload/pyload · GHSA-cjjf-27cc-pvmv

critical2025-10-09

scio is vunerable to Remote Command Execution through PyTorch

thalesgroup/scio · GHSA-m9mp-6x32-5rhg

medium2025-10-08

CVE-2025-9162-Keycloak Potential Variable Reference in Model Storage Services

keycloak/keycloak · GHSA-8hxp-qmph-w5gq

high2025-10-08

CVE-2025-61524-Casdoor is vulnerable to Improper Authorization

casdoor/casdoor · GHSA-5m9m-j5p7-m7f9