Security advisories

medium2025-08-11

CVE-2025-54463-Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions

mattermost/mattermost-plugin-confluence · GHSA-gjpm-6w34-ppvf

low2025-08-11

CVE-2025-53857-Mattermost Confluence Plugin has Missing Authorization vulnerability

mattermost/mattermost-plugin-confluence · GHSA-42m6-5vm7-fjv2

high2025-08-11

CVE-2025-54525-Mattermost Confluence Plugin has Improper Validation of Specified Type of Input

mattermost/mattermost-plugin-confluence · GHSA-3cg3-3mmr-w8hj

low2025-08-11

CVE-2025-49221-Mattermost Confluence Plugin has Missing Authorization vulnerability

mattermost/mattermost-plugin-confluence · GHSA-rfg4-2m63-fw2q

medium2025-08-11

CVE-2025-48731-Mattermost Confluence Plugin has Missing Authorization vulnerability

mattermost/mattermost-plugin-confluence · GHSA-cmpr-8prq-w5p5

high2025-08-11

CVE-2025-44004-Mattermost Confluence Plugin is Missing Authentication for Critical Function

mattermost/mattermost-plugin-confluence · GHSA-6ff3-jgxh-vffj

medium2025-08-11

CVE-2025-44001-Mattermost Confluence Plugin has Missing Authorization vulnerability

mattermost/mattermost-plugin-confluence · GHSA-vpcr-fqpc-386h

medium2025-08-11

CVE-2025-55149-TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)

ulab-uiuc/tiny-scientist · GHSA-rrgf-hcr9-jq6h

medium2025-08-09

CVE-2025-4655-Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

liferay/liferay-portal · GHSA-c6g5-g6r7-q4j6

medium2025-08-09

CVE-2025-4581-Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

liferay/liferay-portal · GHSA-6v93-frf9-2rp8

medium2025-08-08

CVE-2025-54417-Craft CMS has a theoretical bypass for CVE-2025-23209

craftcms/cms · GHSA-2vcf-qxv3-2mgw

medium2025-08-08

CVE-2025-4576-Liferay Portal Reflected XSS in blogs-web

liferay/liferay-portal · GHSA-6qcg-28jh-hm7r

high2025-08-08

CVE-2025-55009-The AuthKit Remix Library renders sensitive auth data in HTML

workos/authkit-remix · GHSA-v3gr-w9gf-23cx

high2025-08-08

CVE-2025-55008-The AuthKit React Router Library rendered sensitive auth data in HTML

workos/authkit-react-router · GHSA-vqvc-9q8x-vmq6

medium2025-08-08

CVE-2025-55001-OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias

openbao/openbao · GHSA-2q8q-8fgw-9p6p

medium2025-08-08

CVE-2025-55003-OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse

openbao/openbao · GHSA-rxp7-9q75-vj3p

medium2025-08-08

CVE-2025-55000-OpenBao TOTP Secrets Engine Code Reuse

openbao/openbao · GHSA-f7c3-mhj2-9pvg

low2025-08-08

CVE-2025-54999-OpenBao has a Timing Side-Channel in the Userpass Auth Method

openbao/openbao · GHSA-hh28-h22f-8357

medium2025-08-08

CVE-2025-54998-OpenBao Userpass and LDAP User Lockout Bypass

openbao/openbao · GHSA-j3xv-7fxp-gfhx

critical2025-08-08

CVE-2025-54997-Privileged OpenBao Operator May Execute Code on the Underlying Host

openbao/openbao · GHSA-xp75-r577-cvhp