Security advisories

critical2025-08-21

CVE-2025-9287-cipher-base is missing type checks, leading to hash rewind and passing on crafted data

browserify/cipher-base · GHSA-cpq7-6gpm-g9rc

high2025-08-21

CVE-2025-9141-vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder

vllm-project/vllm · GHSA-79j6-g2m3-jgfw

medium2025-08-21

CVE-2025-11065-go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data

go-viper/mapstructure · GHSA-2464-8j7c-4cjm

medium2025-08-21

CVE-2025-55744-UnoPim vulnerable to CSRF on Product edit feature and creation of other types

unopim/unopim · GHSA-287x-6r2h-f9mw

high2025-08-21

CVE-2025-55743-UnoPim vulnerable to remote code execution through Arbitrary File upload

unopim/unopim · GHSA-v22v-xwh7-2vrm

medium2025-08-21

CVE-2025-55742-UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality

unopim/unopim · GHSA-xr97-25v7-hc2q

high2025-08-21

CVE-2025-48956-vllm API endpoints vulnerable to Denial of Service Attacks

vllm-project/vllm · GHSA-rxc4-3w6r-4v47

medium2025-08-21

CVE-2025-8023-Mattermost Fails to Sanitize Path Traversal Sequences

mattermost/mattermost · GHSA-x67c-v8jr-p29r

low2025-08-21

CVE-2025-47700-Mattermost Server SSRF Vulnerability via the Agents Plugin

mattermost/mattermost · GHSA-vqwh-5jhh-vc9p

medium2025-08-21

CVE-2025-47870-Mattermost Does Not Sanitize the Team Invite ID

mattermost/mattermost · GHSA-qj47-w9f2-qg44

medium2025-08-21

CVE-2025-49222-Mattermost Fails to Validate Remote Cluster Upload Sessions

mattermost/mattermost · GHSA-q453-638c-h4mr

low2025-08-21

CVE-2025-49810-Mattermost Lack of Access Control Validation

mattermost/mattermost · GHSA-pwvr-grqg-7vp2

medium2025-08-21

CVE-2025-36530-Mattermost Fails to Validate File Paths

mattermost/mattermost · GHSA-gq3r-5833-5532

low2025-08-21

CVE-2025-53971-Mattermost Fails to Properly Validate Team Role Modification

mattermost/mattermost · GHSA-4276-cm8c-788h

low2025-08-21

CVE-2025-9262-wong2 mcp-cli Command Injection Vulnerability

wong2/mcp-cli · GHSA-p6rm-483j-37jf

low2025-08-21

CVE-2025-9264-xxl-job Jobs Handler remove function allows improper control of resource identifiers via ID parameter

xuxueli/xxl-job · GHSA-gjx6-h8hm-c9rq

low2025-08-21

CVE-2025-9263-xxl-job Vulnerable to Resource Injection and Authorization Bypass Through User-Controlled Key

xuxueli/xxl-job · GHSA-6rq7-m52p-8pqg

critical2025-08-20

CVE-2025-54988-Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF

apache/tika · GHSA-p72g-pv48-7w9x

medium2025-08-20

CVE-2025-43746-Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping

liferay/liferay-portal · GHSA-mpww-r37c-vxjw

medium2025-08-20

CVE-2025-43757-Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter

liferay/liferay-portal · GHSA-62pf-hcwj-rcfc