Security advisories

low2025-09-11

CVE-2025-59047-matrix-sdk-base: Panic in the `RoomMember::normalized_power_level()` method

matrix-org/matrix-rust-sdk · GHSA-qhj8-q5r6-8q6j

high2025-09-11

CVE-2025-58754-Axios is vulnerable to DoS attack through lack of data size check

axios/axios · GHSA-4hjh-wcwx-xvwj

medium2025-09-11

CVE-2025-43782-Liferay Portal API Allows Authenticated Users to Access Workflow Definitions by Name

liferay/liferay-portal · GHSA-wr8m-5h2p-4432

high2025-09-11

CVE-2025-43790-Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass

liferay/liferay-portal · GHSA-5wxc-3jfw-w94p

medium2025-09-11

CVE-2025-58065-Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

dpgaspar/flask-appbuilder · GHSA-765j-9r45-w2q2

critical2025-09-11

CVE-2025-59039-Prebid-universal-creative latest on npm briefly compromised

prebid/prebid-universal-creative · GHSA-m662-56rj-8fmm

high2025-09-11

CVE-2025-59038-Prebid.js NPM package briefly compromised

prebid/prebid.js · GHSA-jwq7-6j4r-2f92

medium2025-09-11

CVE-2025-9910-jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin

benjamine/jsondiffpatch · GHSA-33vc-wfww-vjfv

high2025-09-10

CVE-2025-59052-Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

angular/angular · GHSA-68x2-mx4q-78m7

critical2025-09-10

CVE-2025-59046-interactive-git-checkout has a Command Injection vulnerability

ninofiliu/interactive-git-checkout · GHSA-4wcm-7hjf-6xw5

medium2025-09-10

CVE-2025-43783-Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

liferay/liferay-portal · GHSA-jhgr-j9cj-8j62

medium2025-09-10

CVE-2025-43784-Liferay Portal's Incorrect Authorization vulnerability can lead to guest users to obtaining sensitive data

liferay/liferay-portal · GHSA-fvp7-jj9m-3qpf

medium2025-09-10

CVE-2025-59036-Infrahub: Deleted and expired API tokens can still authenticate

opsmill/infrahub · GHSA-v2p7-4pv4-3wwh

high2025-09-10

Shopware: Reflective Cross Site-Scripting (XSS) in CMS components

shopware/shopware · GHSA-9v82-vcjx-m76j

high2025-09-10

CVE-2025-11059-xml2rfc is vulnerable to arbitrary file reads through prepped files

ietf-tools/xml2rfc · GHSA-9mv7-3c64-mmqw

high2025-09-10

CVE-2025-54376-WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled

spectolabs/hoverfly · GHSA-jxmr-2h4q-rhxp

high2025-09-10

CVE-2025-59042-PyInstaller has local privilege escalation vulnerability

pyinstaller/pyinstaller · GHSA-p2xp-xx3r-mffc

high2025-09-10

CVE-2025-59041-Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

anthropics/claude-code · GHSA-j4h9-wv2m-wrf7

medium2025-09-10

CVE-2025-59035-Indico vulnerable to Cross-Site Scripting via LaTeX math code

indico/indico · GHSA-7cf7-9wrr-vrf4

medium2025-09-10

CVE-2025-59034-Indico may disclose unauthorized user details access via legacy API

indico/indico · GHSA-4269-mcfh-cp7q