Security advisories

medium2025-09-09

CVE-2025-43763-Liferay Portal is vulnerable to SSRF through custom object attachment fields

liferay/liferay-portal · GHSA-477q-x55m-j38g

critical2025-09-08

CVE-2025-58450-pREST has a Systemic SQL Injection Vulnerability

prest/prest · GHSA-p46v-f2x8-qp98

high2025-09-08

CVE-2025-58444-MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server

modelcontextprotocol/inspector · GHSA-g9hg-qhmf-q45m

high2025-09-08

CVE-2025-58365-XWiki Blog Application: Privilege Escalation (PR) from account through blog content

xwiki-contrib/application-blog · GHSA-gwj6-xpfg-pxwr

high2025-09-08

CVE-2025-57817-Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation

ethyca/fides · GHSA-hjfh-p8f5-24wr

medium2025-09-08

CVE-2025-57816-Fides Webserver API Rate Limiting Vulnerability in Proxied Environments

ethyca/fides · GHSA-fq34-xw6c-fphf

low2025-09-08

CVE-2025-57815-Fides has a Lack of Brute-Force Protections on Authentication Endpoints

ethyca/fides · GHSA-7q62-r88r-j5gw

low2025-09-08

CVE-2025-57766-Fides' Admin UI User Password Change Does Not Invalidate Current Session

ethyca/fides · GHSA-rpw8-82v9-3q87

critical2025-09-08

CVE-2025-54994-@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API

akoskm/create-mcp-server-stdio · GHSA-3ch2-jxxc-v4xf

high2025-09-08

CVE-2025-56265-N8N's Chat Trigger component is vulnerable to XSS

n8n-io/n8n · GHSA-v2x8-97xq-8xrr

critical2025-09-08

CVE-2025-57285-CodeceptJS's incomprehensive sanitation can lead to Command Injection

codeceptjs/codeceptjs · GHSA-34w8-mcwr-vg29

medium2025-09-08

CVE-2025-10097-SimStudioAI: A function in route.ts is vulnerable to Code Injection

simstudioai/sim · GHSA-g4c9-f287-64xg

high2025-09-08

CVE-2025-57833-Django is subject to SQL injection through its column aliases

django/django · GHSA-6w2r-r2m5-xq5w

medium2025-09-08

CVE-2019-25225-sanitize-html is vulnerable to XSS through incomprehensive sanitization

apostrophecms/sanitize-html · GHSA-qhxp-v273-g94h

medium2025-09-08

CVE-2025-58782-Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data

apache/jackrabbit · GHSA-cxvc-g8f2-4gmm

low2025-09-05

CVE-2025-58445-Atlantis Exposes Service Version Publicly on /status API Endpoint

runatlantis/atlantis · GHSA-xh7v-965r-23f7

medium2025-09-05

CVE-2025-58446-xgrammar vulnerable to denial of service by huge enum grammar

mlc-ai/xgrammar · GHSA-9q5r-wfvf-rr7f

medium2025-09-05

CVE-2025-7445-secrets-store-sync-controller discloses service account tokens in logs

kubernetes-sigs/secrets-store-sync-controller · GHSA-rcw7-pqfp-735x

critical2025-09-05

CVE-2025-58438-internetarchive Vulnerable to Directory Traversal in File.download()

jjjake/internetarchive · GHSA-wx3r-v6h7-frjp

medium2025-09-05

CVE-2025-58369-FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

typelevel/fs2 · GHSA-rrw2-px9j-qffj