Security advisories

medium2025-10-08

CVE-2025-61788-Opencast's Paella Player 7 is vulnerable to Cross-Site Scripting

opencast/opencast · GHSA-m2vg-rmq6-p62r

high2025-10-08

CVE-2025-61687-FlowiseAI/Flosise has File Upload vulnerability

flowiseai/flowise · GHSA-35g6-rrw3-v6xc

high2025-10-08

CVE-2025-61787-Deno is Vulnerable to Command Injection on Windows During Batch File Execution

denoland/deno · GHSA-m2gf-x3f6-8hq3

low2025-10-08

CVE-2025-61786-Deno's --deny-read check does not prevent permission bypass

denoland/deno · GHSA-qq26-84mh-26j9

medium2025-10-08

CVE-2025-61672-Synapse's invalid device keys degrade federation functionality

element-hq/synapse · GHSA-fh66-fcv5-jjfr

medium2025-10-08

CVE-2025-43771-Liferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fields

liferay/liferay-portal · GHSA-q8fj-76q7-4p7h

medium2025-10-08

CVE-2025-61183-VaahCMS is vulnerable to XSS through its Avatar Upload endpoint

webreinvent/vaahcms · GHSA-q769-phqg-263r

medium2025-10-08

CVE-2025-43829-Liferay Portal Commerce Shop is vulnerable to Stored XSS through SVG file

liferay/liferay-portal · GHSA-893r-jr58-3hxr

medium2025-10-08

CVE-2025-43830-Liferay Portal is vulnerable to Stored XSS through Forms text type field

liferay/liferay-portal · GHSA-378f-8q54-3fqx

medium2025-10-08

CVE-2025-43821-Liferay Portal is vulnerable to XSS through its Commerce Product's Name text field

liferay/com-liferay-commerce · GHSA-fjrp-77f3-43xj

high2025-10-08

FuelVM is vulnerable to heap memory allocation re-use bug

fuellabs/fuel-vm · GHSA-2pgj-5cv2-6xxw

critical2025-10-08

CVE-2025-10352-Melis Platform CMS Unauthenticated Admin Account Creation

melisplatform/melis-core · GHSA-p3vc-g9f9-mgw4

critical2025-10-08

CVE-2025-10351-Melis Platform CMS SQL Injection

melisplatform/melis-cms · GHSA-mrmx-jfw8-qhgv

critical2025-10-08

CVE-2025-10353-Melis Platform CMS Unauthenticated File Upload Leading to RCE

melisplatform/melis-cms-slider · GHSA-chw4-gjvw-3gxc

medium2025-10-08

CVE-2025-43823-Liferay Portal is vulnerable to XSS through its Commerce Search Result widget

liferay/liferay-portal · GHSA-xx7h-2wf7-hc7p

medium2025-10-08

CVE-2025-43822-Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page

liferay/liferay-portal · GHSA-4mqx-4p8g-995w

low2025-10-07

CVE-2025-61785-Deno's --deny-write check does not prevent permission bypass

denoland/deno · GHSA-vg2r-rmgp-cgqj

high2025-10-07

CVE-2025-6242-vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

vllm-project/vllm · GHSA-3f6c-7fw2-ppm4

high2025-10-07

CVE-2025-61784-LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities

hiyouga/llama-factory · GHSA-527m-2xhr-j27g

medium2025-10-07

CVE-2025-61620-vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server

vllm-project/vllm · GHSA-6fvq-23cw-5628