Security advisories

high2025-09-09

CVE-2025-58451-Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity

ieaturanium238/cattown · GHSA-455v-w7r9-3vv9

high2025-09-09

CVE-2025-58430-listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover

knadh/listmonk · GHSA-rf24-wg77-gq7w

high2025-09-09

CVE-2025-58180-OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload

octoprint/octoprint · GHSA-49mj-x8jp-qvfc

high2025-09-09

CVE-2025-58063-CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion

coredns/coredns · GHSA-93mf-426m-g6x9

medium2025-09-09

CVE-2025-57665-Element Plus Link component (el-link) implements insufficient input validation for the href attribute

element-plus/element-plus · GHSA-5m5x-9j46-h678

high2025-09-09

CVE-2024-43115-Apache DolphinScheduler vulnerable to Alert Script Attack

apache/dolphinscheduler · GHSA-3vcp-r62v-xpvg

medium2025-09-09

CVE-2025-43776-Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting

liferay/liferay-portal · GHSA-rcc7-jx7p-hrv4

medium2025-09-09

CVE-2025-52277-YesWiki Cross Site Scripting vulnerability

yeswiki/yeswiki · GHSA-29cj-cxw4-v4j2

critical2025-09-09

CVE-2025-54236-Magento Community Edition Improper Input Validation vulnerability

magento/magento2 · GHSA-wh92-6q6g-px7j

high2025-09-09

toodee is vulnerable to Heap Buffer Overflow through its DrainCol Destructor

antonmarsden/toodee · GHSA-pfp7-vxgr-83pw

medium2025-09-09

CVE-2025-58753-copyparty: Sharing a single file does not fully restrict access to other files in source folder

9001/copyparty · GHSA-pxvw-4w88-6x95

high2025-09-09

CVE-2025-59037-DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware

duckdb/duckdb-node · GHSA-w62p-hx95-gf2c

high2025-09-09

CVE-2025-59018-TYPO3 Workspaces Module Information Disclosure

typo3-cms/workspaces · GHSA-w2pf-7q5w-2cgw

medium2025-09-09

CVE-2025-59016-TYPO3 CMS exposes sensitive information in an error message

typo3-cms/core · GHSA-cvm2-5f78-g9m8

medium2025-09-09

CVE-2025-59014-TYPO3 Bookmark Toolbar vulnerable to denial of service

typo3-cms/backend · GHSA-xrcq-533q-8rxw

medium2025-09-09

CVE-2025-59015-TYPO3 CMS uses insufficient entropy when generating passwords

typo3-cms/core · GHSA-p5jq-5383-qvc7

medium2025-09-09

CVE-2025-59013-TYPO3 CMS has an open‑redirect vulnerability

typo3-cms/core · GHSA-72jf-5fg5-3cw3

medium2025-09-09

CVE-2025-43778-Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin

liferay/liferay-portal · GHSA-cpg4-qcj8-42gp

medium2025-09-09

CVE-2025-43777-Liferay Portal exposes 500 status when attempting login with a deleted client secret

liferay/liferay-portal · GHSA-9vwq-j6gq-w9xh

low2025-09-09

CVE-2025-43774-Liferay Portal is vulnerable to XSS attack through its Style Book theme

liferay/liferay-portal · GHSA-qgj5-4qvg-2f8c