Security advisories

critical2025-08-20

CVE-2025-55746-Directus allows unauthenticated file upload and file modification due to lacking input sanitization

directus/directus · GHSA-mv33-9f6j-pfmc

critical2025-08-20

CVE-2011-10026-Spree Commerce is vulnerable to RCE through Search API

spree/spree · GHSA-x485-rhg3-cqr4

high2025-08-20

CVE-2025-43748-Liferay Portal Vulnerable to Cross-Site Request Forgery

liferay/liferay-portal · GHSA-p9gc-59hf-x48p

medium2025-08-20

CVE-2025-50864-elysia-cors Origin Validation Error

elysiajs/elysia-cors · GHSA-f9qj-4c5x-cpcw

medium2025-08-20

CVE-2025-4437-CRI-O has Potential High Memory Consumption from File Read

cri-o/cri-o · GHSA-8f93-j3fx-72f3

medium2025-08-20

CVE-2025-43749-Liferay Portal Unauthenticated File Access via URL

liferay/liferay-portal · GHSA-5fx5-cff6-f3fp

medium2025-08-20

CVE-2025-43750-Liferay Portal Unvalidated File Upload

liferay/liferay-portal · GHSA-56qj-wp5r-mvhj

medium2025-08-20

CVE-2025-43741-Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter

liferay/liferay-portal · GHSA-j6p8-g3rj-ghpm

medium2025-08-20

CVE-2025-43742-Liferay Portal Vulnerable to Cross-Site Scripting through URLs

liferay/liferay-portal · GHSA-3fp2-6mwq-4q3j

medium2025-08-20

CVE-2024-39954-Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java

apache/eventmesh · GHSA-hf86-8x8v-h7vc

medium2025-08-19

CVE-2025-55740-Default Credentials in nginx-defender Configuration Files

anipaleja/nginx-defender · GHSA-pr72-8fxw-xx22

medium2025-08-19

CVE-2025-43744-Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels

liferay/liferay-portal · GHSA-m49p-6cjp-x2h3

medium2025-08-19

CVE-2025-43743-Liferay Portal Enumeration Discrepancy in Calendars

liferay/liferay-portal · GHSA-g4vp-4gqr-7v8c

medium2025-08-19

CVE-2025-43737-Liferay Portal Vulnerable to Cross-Site Scripting via backURL Paramter

liferay/liferay-portal · GHSA-vjwr-cqwf-6q96

medium2025-08-19

CVE-2025-43745-Liferay Portal CSRF Vulnerability via Endpoint Parameter

liferay/liferay-portal · GHSA-7q33-gwcm-r6cj

medium2025-08-19

CVE-2025-8678-WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery

johnbillion/wp-crontrol · GHSA-35c5-67fm-cpcp

critical2025-08-19

CVE-2025-55294-screenshot-desktop vulnerable to command Injection via `format` option

bencevans/screenshot-desktop · GHSA-gjx4-2c7g-fm94

medium2025-08-19

CVE-2025-54881-Mermaid improperly sanitizes sequence diagram labels leading to XSS

mermaid-js/mermaid · GHSA-7rqq-prvp-x9jh

medium2025-08-19

CVE-2025-54880-Mermaid does not properly sanitize architecture diagram iconText leading to XSS

mermaid-js/mermaid · GHSA-8gwm-58g9-j8pw

medium2025-08-19

CVE-2025-43738-Liferay Portal Reflected Cross-Site Scripting Vulnerability in displayType Parameter

liferay/liferay-portal · GHSA-cwgh-r52j-xh6c