Security advisories

medium2025-09-17

CVE-2025-59410-DragonFly's tiny file download uses hard coded HTTP protocol

dragonflyoss/dragonfly · GHSA-mcvp-rpgg-9273

medium2025-09-17

CVE-2025-59354-DragonFly has weak integrity checks for downloaded files

dragonflyoss/dragonfly · GHSA-hx2h-vjw2-8r54

high2025-09-17

CVE-2025-59353-DragonFly's manager generates mTLS certificates for arbitrary IP addresses

dragonflyoss/dragonfly · GHSA-255v-qv84-29p5

medium2025-09-17

CVE-2025-59352-DragonFly vulnerable to arbitrary file read and write on a peer machine

dragonflyoss/dragonfly · GHSA-79hx-3fp8-hj66

medium2025-09-17

CVE-2025-59351-DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error

dragonflyoss/dragonfly · GHSA-4mhv-8rh3-4ghw

medium2025-09-17

CVE-2025-59350-Dragonfly vulnerable to timing attacks against Proxy’s basic authentication

dragonflyoss/dragonfly · GHSA-c2fc-9q9c-5486

critical2025-09-17

CVE-2025-59340-jinjava has Sandbox Bypass via JavaType-Based Deserialization

hubspot/jinjava · GHSA-m49c-g9wr-hv6v

low2025-09-17

CVE-2025-59349-Dragonfly's directories created via os.MkdirAll are not checked for permissions

dragonflyoss/dragonfly · GHSA-8425-8r2f-mrv6

medium2025-09-17

CVE-2025-59348-Dragonfly incorrectly handles a task structure’s usedTrac field

dragonflyoss/dragonfly · GHSA-2qgr-gfvj-qpcr

medium2025-09-17

CVE-2025-59347-Dragonfly's manager makes requests to external endpoints with disabled TLS authentication

dragonflyoss/dragonfly · GHSA-98x5-jw98-6c97

high2025-09-17

CVE-2025-59346-Dragonfly vulnerable to server-side request forgery

dragonflyoss/dragonfly · GHSA-g2rq-jv54-wcpr

high2025-09-17

CVE-2025-59345-Dragonfly doesn't have authentication enabled for some Manager’s endpoints

dragonflyoss/dragonfly · GHSA-89vc-vf32-ch59

medium2025-09-17

CVE-2025-59342-esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header

esm-dev/esm.sh · GHSA-g2h5-cvvr-7gmw

high2025-09-17

CVE-2025-59341-esm.sh has File Inclusion issue

esm-dev/esm.sh · GHSA-49pv-gwxp-532r

low2025-09-17

CVE-2025-58767-REXML has DoS condition when parsing malformed XML file

ruby/rexml · GHSA-c2f4-jgmc-q2r5

medium2025-09-17

CVE-2025-59476-Jenkins has a log message injection vulnerability

jenkinsci/jenkins · GHSA-qrh5-jg98-cr48

medium2025-09-17

CVE-2025-59475-Jenkins is missing a permission check in the authenticated users' profile menu

jenkinsci/jenkins · GHSA-223m-4rfp-646h

medium2025-09-17

CVE-2025-43804-Liferay search widget vulnerable to Cross-site Scripting

liferay/liferay-portal · GHSA-ccrc-5vp5-vp5j

medium2025-09-17

CVE-2025-9708-Kubernetes C# client accepts certificates from any CA without properly verifying the trust chain

kubernetes-client/csharp · GHSA-w7r3-mgwf-4mqq

medium2025-09-17

CVE-2025-43805-Liferay Portal allows remote attackers to view display page templates via crafted URLs

liferay/liferay-portal · GHSA-5pp7-m8x8-rc82