Security advisories

low2025-09-15

CVE-2025-9084-Mattermost Open Redirect vulnerability

mattermost/mattermost · GHSA-hm95-jx66-g2gh

medium2025-09-15

CVE-2025-9078-Mattermost makes Use of Weak Hash

mattermost/mattermost · GHSA-9p92-x77w-9fw2

high2025-09-15

CVE-2025-9072-Mattermost Open Redirect vulnerability

mattermost/mattermost · GHSA-69j8-prx2-vx98

critical2025-09-15

CVE-2025-59359-Chaos Controller Manager is vulnerable to OS command injection

chaos-mesh/chaos-mesh · GHSA-369h-6j28-wwcg

high2025-09-15

CVE-2025-59358-Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function

chaos-mesh/chaos-mesh · GHSA-2gg8-85m5-8r2p

critical2025-09-15

CVE-2025-59361-Chaos Controller Manager is vulnerable to OS command injection

chaos-mesh/chaos-mesh · GHSA-2gcv-3qpf-c5qr

medium2025-09-15

CVE-2025-9076-Mattermost Missing Authorization vulnerability

mattermost/mattermost · GHSA-3vcm-c42p-3hhf

medium2025-09-14

CVE-2025-6051-Hugging Face Transformers library has Regular Expression Denial of Service

huggingface/transformers · GHSA-rcv9-qm8p-9p6j

medium2025-09-12

CVE-2025-43795-Liferay Portal's System, Instance and Site Settings are vulnerable to Open Redirect

liferay/liferay-portal · GHSA-m55r-9fx8-725j

high2025-09-12

CVE-2025-43796-Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack

liferay/liferay-portal · GHSA-f3hf-r62c-mfrj

medium2025-09-12

CVE-2025-59139-Hono has Body Limit Middleware Bypass

honojs/hono · GHSA-92vj-g62v-jqhh

medium2025-09-12

CVE-2025-59058-httpsig-rs: HMAC verification is vulnerable to timing attack

junkurihara/httpsig-rs · GHSA-q7pg-9pr4-mrp2

critical2025-09-12

CVE-2025-58434-Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

flowiseai/flowise · GHSA-wgpv-6j63-x5ph

medium2025-09-12

CVE-2025-43787-Liferay Portal's selection modal is vulnerable to XSS

liferay/liferay-portal · GHSA-g8fh-pfw3-8rmr

medium2025-09-12

CVE-2025-6638-Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

huggingface/transformers · GHSA-59p9-h35m-wg4g

medium2025-09-12

CVE-2025-43788-Liferay Portal's Organization Selector exposes organization data to remote authenticated users

liferay/liferay-portal · GHSA-v53g-736w-mgw4

low2025-09-12

CVE-2025-43789-Liferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy Execution

liferay/liferay-portal · GHSA-q86r-gwqc-jx85

high2025-09-11

CVE-2025-10193- Neo4j Cypher MCP server is vulnerable to DNS rebinding

neo4j-contrib/mcp-neo4j · GHSA-vcqx-v2mg-7chx

medium2025-09-11

CVE-2025-11060-SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

surrealdb/surrealdb · GHSA-7vm2-j586-vcvc

medium2025-09-11

CVE-2025-56556-Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool

intelliants/subrion · GHSA-h8wv-vv58-468h