Security advisories

critical2025-09-15

CVE-2025-59528-Flowise has Remote Code Execution vulnerability

flowiseai/flowise · GHSA-3gcm-f6qx-ff7p

high2025-09-15

CVE-2025-59527-FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability

flowiseai/flowise · GHSA-hr92-4q35-4j3m

critical2025-09-15

CVE-2025-57164-FlowiseAI Pre-Auth Arbitrary Code Execution

flowiseai/flowise · GHSA-7944-7c6r-55vv

medium2025-09-15

CVE-2025-43793-Liferay Portal has Improper Validation of Specified Quantity in Input

liferay/liferay-portal · GHSA-xvgg-9h29-4g34

low2025-09-15

CVE-2025-43792-Liferay Portal has External Control of System or Configuration Settings

liferay/liferay-portal · GHSA-vp64-77c6-33h8

medium2025-09-15

CVE-2025-59397-Open Web Analytics Server is vulnerable to SQL Injection

open-web-analytics/open-web-analytics · GHSA-6w8r-xgqq-qg6g

medium2025-09-15

CVE-2025-59328-Apache Fory Deserialization of Untrusted Data vulnerability

apache/fory · GHSA-5hmf-8wx5-4qq3

medium2025-09-15

CVE-2025-43791-Liferay Portal vulnerable to Cross-site Scripting

liferay/liferay-portal · GHSA-5c6v-fqcw-w6q5

high2025-09-15

FUSE-Rust: Uninitalized memory read and leak caused by fuser crate

cberner/fuser · GHSA-cvmj-47v9-35m9

medium2025-09-15

CVE-2025-58177-Stored XSS in n8n LangChain Chat Trigger Node via initialMessages Parameter

n8n-io/n8n · GHSA-mvh4-2cm2-6hpg

high2025-09-15

CVE-2025-54588-Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults

envoyproxy/envoy · GHSA-g9vw-6pvx-7gmw

high2025-09-15

CVE-2025-48042-Before action, Ash's hooks may execute in certain scenarios despite a request being forbidden

ash-project/ash · GHSA-jj4j-x5ww-cwh9

medium2025-09-15

CVE-2025-8396-Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling

temporalio/temporal · GHSA-p768-c3pr-6459

medium2025-09-15

CVE-2025-59376-mcp-kubernetes-server has a Command Injection vulnerability

feiskyer/mcp-kubernetes-server · GHSA-hjm5-xgj8-vwj6

critical2025-09-15

CVE-2025-59377-mcp-kubernetes-server has an OS Command Injection vulnerability

feiskyer/mcp-kubernetes-server · GHSA-4hqq-7q79-932p

medium2025-09-15

serde_yml crate is unsound and unmaintained

sebastienrousseau/serde_yml · GHSA-hhw4-xg65-fp2x

high2025-09-15

LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained

sebastienrousseau/libyml · GHSA-gfxp-f68g-8x78

medium2025-09-15

MetaMask SDK indirectly exposed via malicious [email protected] dependency

metamask/metamask-sdk · GHSA-qj3p-xc97-xw74

critical2025-09-15

CVE-2025-59360-Chaos Controller Manager is vulnerable to OS command injection

chaos-mesh/chaos-mesh · GHSA-xv9f-728h-9jgv

medium2025-09-15

CVE-2025-43794-Liferay Portal has stored cross-site scripting (XSS) vulnerability

liferay/liferay-portal · GHSA-r45v-2289-jgr4