Security advisories

low2025-10-01

CVE-2025-59682-Django vulnerable to partial directory traversal via archives

django/django · GHSA-q95w-c7qg-hrff

high2025-10-01

CVE-2025-56588-Dolibarr vulnerable to RCE via the computed field parameter

dolibarr/dolibarr · GHSA-27hj-48r9-x2vx

high2025-10-01

CVE-2025-59681-Django vulnerable to SQL injection in column aliases

django/django · GHSA-hpr9-3m2g-3j9p

low2025-10-01

Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import

auth0/symfony · GHSA-7jp2-5h22-m432

low2025-10-01

Auth0 Wordpress plugin Does Not Properly Handle File Types in Bulk User Import

auth0/wordpress · GHSA-w22c-pw5m-482x

low2025-10-01

laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import

auth0/laravel-auth0 · GHSA-hjfh-5jmm-xr24

low2025-10-01

CVE-2025-58769-auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import

auth0/auth0-php · GHSA-9mh6-g99m-ppcw

medium2025-10-01

marimo vulnerable to proxy abuse of /mpl/{port}/

marimo-team/marimo · GHSA-xjv7-6w92-42r7

critical2025-10-01

CVE-2025-61588-risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`

risc0/risc0 · GHSA-jqq4-c7wq-36h7

low2025-10-01

CVE-2025-56514-Fiora chat user avatar is vulnerable to XSS via SVG files

yinxin630/fiora · GHSA-hg3j-6pmh-mvjr

low2025-10-01

CVE-2025-56515-Fiora chat group avatar is vulnerable to XSS via SVG files

yinxin630/fiora · GHSA-2c6j-vw6r-mfch

high2025-10-01

CVE-2025-61668- @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user

plone/volto · GHSA-m8rj-ppph-mj33

medium2025-10-01

CVE-2025-57275-SPDK is vulnerable to buffer overflow in the NVMe-oF target component

spdk/spdk · GHSA-5m5w-w2h2-fqgq

critical2025-10-01

CVE-2025-61622-Apache Pyfory python is vulnerable to deserialization of untrusted data

apache/fory · GHSA-538v-3wq9-4h3r

medium2025-10-01

CVE-2025-11226-QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing

qos-ch/logback · GHSA-25qh-j22f-pwp8

medium2025-10-01

CVE-2025-43826-Liferay Portal Vulnerable to XSS in Web Content translation

liferay/liferay-portal · GHSA-qh92-cr5f-3595

medium2025-09-30

CVE-2025-43827-Liferay Portal Vulnerable to IDOR via audit events

liferay/liferay-portal · GHSA-pw86-qvx9-34r7

high2025-09-30

CVE-2025-61595-github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks

mantra-chain/mantrachain · GHSA-qwvm-wqq8-8j69

high2025-09-30

CVE-2025-59538-Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

argoproj/argo-cd · GHSA-gpx4-37g2-c8pv

medium2025-09-30

CVE-2025-56200-validator.js has a URL validation bypass vulnerability in its isURL function

validatorjs/validator.js · GHSA-9965-vmph-33xx