Security advisories

medium2025-09-16

CVE-2025-59432-Timing Attack Vulnerability in SCRAM Authentication

ongres/scram · GHSA-3wfh-36rx-9537

medium2025-09-16

CVE-2025-59160-matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

matrix-org/matrix-js-sdk · GHSA-mp7c-m3rh-r56v

high2025-09-16

CVE-2025-59333-@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode

executeautomation/mcp-database-server · GHSA-65hm-pwj5-73pw

high2025-09-16

CVE-2025-10492-JasperReports has a Java deserialisation vulnerability

jaspersoft/jasperreports · GHSA-7c3f-cg9x-f3gr

high2025-09-16

CVE-2025-4953-Podman Creates Temporary File with Insecure Permissions

containers/podman · GHSA-m68q-4hqr-mc6f

high2025-09-16

CVE-2025-41249-Spring Framework annotation detection mechanism may result in improper authorization

spring-projects/spring-framework · GHSA-jmp9-x22r-554x

high2025-09-16

CVE-2025-41248-Spring Security annotation detection mechanism has authorization bypass

spring-projects/spring-security · GHSA-8v5q-rhf3-jphm

medium2025-09-16

CVE-2025-59154-Openfire has potential identity spoofing issue via unsafe CN parsing

igniterealtime/openfire · GHSA-w252-645g-87mp

medium2025-09-16

CVE-2025-43802-Liferay Stored Cross-site Scripting vulnerability

liferay/liferay-portal · GHSA-vg6h-g5mr-9hgv

medium2025-09-16

CVE-2025-43797-Liferay has Insecure Default Initialization of Resource issue

liferay/liferay-portal · GHSA-25m3-w28p-v3v3

high2025-09-15

[email protected] contains malware after npm account takeover

colorjs/color-name · GHSA-5fvm-p68v-5wmh

low2025-09-15

CVE-2025-43798-Liferay DXP Missing Critical Step in Authentication

liferay/liferay-portal · GHSA-4p5r-3jmm-652q

medium2025-09-15

CVE-2025-43799-Liferay Portal Uses Default Password

liferay/liferay-portal · GHSA-43xf-59vr-g4f2

medium2025-09-15

CVE-2025-43800-Liferay Portal Cross-site Scripting (XSS) vulnerability

liferay/liferay-portal · GHSA-jfv5-r382-xvwh

high2025-09-15

[email protected] contains malware after npm account takeover

debug-js/debug · GHSA-4x49-vf9v-38px

medium2025-09-15

CVE-2025-59155-HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability

yuna0x0/hackmd-mcp · GHSA-g5cg-6c7v-mmpw

medium2025-09-15

CVE-2025-9862-Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark

tryghost/ghost · GHSA-f7qg-xj45-w956

critical2025-09-15

CVE-2025-71336-Flowise has unsandboxed remote code execution via Custom MCP

flowiseai/flowise · GHSA-6933-jpx5-q87q

critical2025-09-15

CVE-2025-71334-Flowise has arbitrary file access due to missing chat flow id validation

flowiseai/flowise · GHSA-q67q-549q-p849

critical2025-09-15

Flowise has an Arbitrary File Read

flowiseai/flowise · GHSA-99pg-hqvx-r4gf