Security advisories

low2025-09-22

Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal

rust-ammonia/ammonia · GHSA-mm7x-qfjj-5g2c

high2025-09-22

CVE-2025-59420-Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

authlib/authlib · GHSA-9ggr-2464-2j32

high2025-09-19

CVE-2025-9079-Mattermost Path Traversal vulnerability

mattermost/mattermost · GHSA-qx3f-6vq3-8j8m

low2025-09-19

CVE-2025-9081-Mattermost boards plugin fails to restrict download access to files

mattermost/mattermost-plugin-boards · GHSA-f72g-52v7-mg3p

medium2025-09-19

CVE-2025-43808-Liferay Portal Commerce component has Incorrect Permission Assignment for Critical Resource

liferay/liferay-portal · GHSA-chr3-w547-85hw

medium2025-09-19

CVE-2025-43803-Liferay Contacts Center widget has insecure direct object reference

liferay/liferay-portal · GHSA-8c8v-r5jj-4425

high2025-09-19

CVE-2025-9905-The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.

keras-team/keras · GHSA-36rr-ww3j-vrjv

high2025-09-19

CVE-2025-59532-Codex has sandbox bypass due to bug in path configuration logic

openai/codex · GHSA-w5fx-fh39-j5rw

medium2025-09-19

CVE-2025-10630-Grafana-Zabbix ReDoS vulnerability

grafana/grafana-zabbix · GHSA-g4rr-88fc-26fj

high2025-09-19

CVE-2025-9906-Keras is vulnerable to Deserialization of Untrusted Data

keras-team/keras · GHSA-36fq-jgmw-4r9c

medium2025-09-19

CVE-2025-59717-@digitalocean/do-markdownit has Type Confusion vulnerability

digitalocean/do-markdownit · GHSA-2h8j-8r9p-849f

medium2025-09-19

CVE-2025-59713-Snipe-IT allows unsafe deserialization

grokability/snipe-it · GHSA-phwj-fgch-xvrj

medium2025-09-19

CVE-2025-59712-Snipe-IT allows XSS

grokability/snipe-it · GHSA-c9wp-pr7f-hfqm

medium2025-09-18

CVE-2025-59417-Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages

lobehub/lobe-chat · GHSA-m79r-r765-5f9j

critical2025-09-18

CVE-2025-6237-InvokeAI has External Control of File Name or Path

invoke-ai/invokeai · GHSA-vv9c-xxg7-wmv7

medium2025-09-17

CVE-2025-10619-@sequa-ai/sequa-mcp has Command Injection vulnerability

sequa-ai/sequa-mcp · GHSA-9pw5-wx67-q964

medium2025-09-17

CVE-2025-56648-Parcel has an Origin Validation Error vulnerability

parcel-bundler/parcel · GHSA-qm9p-f9j5-w83w

high2025-09-17

Pingora update for MadeYouReset HTTP/2 vulnerability

cloudflare/pingora · GHSA-393w-9x6h-8gc7

low2025-09-17

CVE-2025-59414-Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival

nuxt/nuxt · GHSA-p6jq-8vc4-79f6

medium2025-09-17

CVE-2025-8419-Keycloak SMTP Inject Vulnerability

keycloak/keycloak · GHSA-m4j5-5x4r-2xp9