Security advisories

critical2025-09-10

CVE-2025-10155-Picklescan Bypass is Possible via File Extension Mismatch

mmaitre314/picklescan · GHSA-jgw4-cr84-mqxg

critical2025-09-10

CVE-2025-10156-Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check

mmaitre314/picklescan · GHSA-mjqp-26hc-grxg

critical2025-09-10

CVE-2025-54123-Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation

spectolabs/hoverfly · GHSA-r4h8-hfp2-ggmf

medium2025-09-10

CVE-2025-57520-Decap CMS Cross Site Scripting (XSS) vulnerability

decaporg/decap-cms · GHSA-xp8g-32qh-mv28

medium2025-09-10

CVE-2025-43785-Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting

liferay/liferay-portal · GHSA-66x6-8jgv-qpfh

critical2025-09-10

CVE-2025-10157-Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports

mmaitre314/picklescan · GHSA-f7qq-56ww-84cr

high2025-09-10

CVE-2025-58765-Webrecorder packages are vulnerable to XSS through 404 error handling logic

webrecorder/wabac.js · GHSA-w765-jm6w-4hhj

high2025-09-10

CVE-2025-58764-Claude Code rg vulnerability does not protect against approval prompt bypass

anthropics/claude-code · GHSA-qxfv-fcpc-w36x

medium2025-09-09

CVE-2025-43786-Liferay Portal exposes ERC which can lead to exploit the time response attack

liferay/liferay-portal · GHSA-9p7x-8c57-4pqv

medium2025-09-09

CVE-2025-43781-Liferay Portal is vulnerable to XSS attack through its search bar portlet

liferay/liferay-portal · GHSA-x5fw-8xgx-q6c9

medium2025-09-09

CVE-2025-10164-SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor

sgl-project/sglang · GHSA-9w53-xr52-mwgj

medium2025-09-09

CVE-2025-43775-Liferay Portal is vulnerable to XSS attacks via its remote app title field

liferay/liferay-portal · GHSA-88g3-pv3w-5wmr

high2025-09-09

CVE-2025-58757-Monai: Unsafe use of Pickle deserialization may lead to RCE

project-monai/monai · GHSA-p8cm-mm2v-gwjm

high2025-09-09

CVE-2025-58756-MONAI: Unsafe torch usage may lead to arbitrary code execution

project-monai/monai · GHSA-6vm5-6jv9-rjpj

high2025-09-09

CVE-2025-58755-MONAI does not prevent path traversal, potentially leading to arbitrary file writes

project-monai/monai · GHSA-x6ww-pf9m-m73m

medium2025-09-09

CVE-2025-58759-TinyEnv: Inline comments not stripped properly in .env values

datahihi1/tiny-env · GHSA-72cm-7236-h43r

medium2025-09-09

CVE-2025-58758-TinyEnv: Missing .env file not required — may cause unexpected behavior

datahihi1/tiny-env · GHSA-3j7m-5g4q-gfpc

low2025-09-09

CVE-2025-58751-Vite middleware may serve files starting with the same name with the public directory

vitejs/vite · GHSA-g4jq-h2w9-997c

low2025-09-09

CVE-2025-58752-Vite's `server.fs` settings were not applied to HTML files

vitejs/vite · GHSA-jqfw-vq24-v9c3

high2025-09-09

CVE-2025-58449-Maho is Vulnerable to Authenticated Remote Code Execution via File Upload

mahocommerce/maho · GHSA-vgmm-27fc-vmgp