Security advisories

medium2025-09-30

CVE-2025-54476-Joomla! CMS vulnerable to XSS via the input filter

joomla/joomla-cms · GHSA-fm22-g2q9-j3pw

high2025-09-30

CVE-2025-56571-Finance.js vulnerable to DoS via the IRR function’s depth parameter

ebradyjobory/finance.js · GHSA-f8r4-mf27-rf7m

medium2025-09-30

CVE-2025-55797-FormCMS has an improper access control vulnerability in the /api/schemas/history/[schemaId] endpoint

formcms/formcms · GHSA-6cwx-42hw-w69c

high2025-09-30

CVE-2025-56572-Finance.js vulnerable to DoS via the seekZero() parameter

ebradyjobory/finance.js · GHSA-5q7q-p8pc-782h

high2025-09-30

CVE-2025-59537-argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload

argoproj/argo-cd · GHSA-wp4p-9pxh-cgx2

high2025-09-30

CVE-2025-59531-Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload

argoproj/argo-cd · GHSA-f9gq-prrc-hrhc

medium2025-09-30

CVE-2025-55191-Repository Credentials Race Condition Crashes Argo CD Server

argoproj/argo-cd · GHSA-g88p-r42r-ppp9

high2025-09-30

CVE-2025-53967-figma-developer-mcp vulnerable to command injection in get_figma_data tool

glips/figma-context-mcp · GHSA-gxw4-4fc5-9gr5

critical2025-09-30

CVE-2025-11148-check-branches is vulnerable to command Injection

puntorigen/check-branches · GHSA-9c4g-fp4r-prrv

high2025-09-30

CVE-2025-11149-@nubosoftware/node-static failure to catch exception can result in server crash

cloudhead/node-static · GHSA-27w5-gj5q-82fv

medium2025-09-30

CVE-2025-43815-Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page

liferay/liferay-portal · GHSA-wmjx-xv9v-r89q

medium2025-09-30

CVE-2025-43820-Liferay Portal vulnerable to cross-site scripting in the Calendar widget

liferay/liferay-portal · GHSA-pf86-4w35-cj89

medium2025-09-30

CVE-2025-43817-Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter

liferay/liferay-portal · GHSA-m4hg-46pw-6mmv

medium2025-09-30

CVE-2025-43812-Liferay Portal vulnerable to cross-site scripting in the web content template

liferay/liferay-portal · GHSA-jv8x-mm3v-75r7

medium2025-09-30

CVE-2025-43818-Liferay Portal vulnerable to cross-site scripting in the Calendar widget

liferay/liferay-portal · GHSA-gj92-p9mh-83j8

medium2025-09-30

CVE-2025-43813-Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet

liferay/liferay-portal · GHSA-2hm7-r8f3-423h

medium2025-09-30

CVE-2025-43811-Liferay Portal vulnerable to cross-site scripting in the related asset selector

liferay/liferay-portal · GHSA-2856-xf2f-6vrf

medium2025-09-29

CVE-2025-59956-Coder AgentAPI exposed user chat history via a DNS rebinding attack

coder/agentapi · GHSA-w64r-2g3w-w8w4

high2025-09-29

CVE-2025-59942-go-f3 module vulnerable to integer overflow leading to panic

filecoin-project/go-f3 · GHSA-g99p-47x7-mq88

medium2025-09-29

CVE-2025-59941-go-f3 Vulnerable to Cached Justification Verification Bypass

filecoin-project/go-f3 · GHSA-7pq9-rf9p-wcrf