Security advisories

medium2025-09-23

CVE-2024-6429-WSO2 Identity Server Apps allows content spoofing in logs

wso2/identity-apps · GHSA-r6f3-55wj-g9p3

medium2025-09-23

CVE-2025-59825-astral-tokio-tar has a path traversal in tar extraction

astral-sh/tokio-tar · GHSA-3wgq-wrwc-vqmv

medium2025-09-23

CVE-2025-59822-Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section

http4s/http4s · GHSA-wcwh-7gfw-5wrr

medium2025-09-23

CVE-2025-4760-WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability

wso2/carbon-apimgt · GHSA-cmjc-qp7j-xgwr

medium2025-09-23

CVE-2025-6921-Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

huggingface/transformers · GHSA-4w7r-h757-3r74

medium2025-09-23

CVE-2025-59821-DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

dnnsoftware/dnn.platform · GHSA-jc4g-c8ww-5738

low2025-09-23

CVE-2025-59546-DNN Vulnerable to Stored XSS Using Backend Admin Credentials

dnnsoftware/dnn.platform · GHSA-gj8m-5492-q98h

critical2025-09-23

CVE-2025-59545-DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module

dnnsoftware/dnn.platform · GHSA-2qxc-mf4x-wr29

medium2025-09-23

CVE-2025-43806-Liferay Portal and DXP does not properly check permission with import and export tasks

liferay/liferay-portal · GHSA-pm45-xx4q-fmv7

medium2025-09-23

CVE-2025-43814-Liferay Portal and DXP audit events record password reminder answers

liferay/liferay-portal · GHSA-ph63-chvv-8x46

medium2025-09-23

CVE-2025-43810-Liferay Portal and DXP allows users to add a note to a different virtual instance

liferay/liferay-portal · GHSA-f372-9rcj-8w2c

medium2025-09-22

CVE-2025-59539-DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

dnnsoftware/dnn.platform · GHSA-7rcc-q6rq-jpcm

medium2025-09-22

CVE-2025-59535-DNN allows loading unused themes on anonymous clients through query parameters

dnnsoftware/dnn.platform · GHSA-wq2j-w9pm-7x2p

high2025-09-22

CVE-2025-59430-Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink

frontfin/mesh-web-sdk · GHSA-vh3f-qppr-j97f

medium2025-09-22

CVE-2025-43807-Liferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text field

liferay/liferay-portal · GHSA-jh9h-8xf2-25wj

critical2025-09-22

CVE-2025-6544-H2O affected by a deserialization vulnerability

h2oai/h2o-3 · GHSA-5w3j-gwgh-4rfv

medium2025-09-22

CVE-2025-40843-CodeChecker has a buffer overflow in the log command

ericsson/codechecker · GHSA-5xf2-f6ch-6p8r

medium2025-09-22

CVE-2025-59526-Mailgen: HTML injection vulnerability in plaintext e-mails

eladnava/mailgen · GHSA-j2xj-h7w5-r7vp

high2025-09-22

CVE-2025-59831-`git-comiters` Command Injection vulnerability

snowyu/git-commiters.js · GHSA-g38c-wxjf-xrh6

medium2025-09-22

CVE-2025-59433-@conventional-changelog/git-client has Argument Injection vulnerability

conventional-changelog/conventional-changelog · GHSA-vh25-5764-9wcr