Security advisories

medium2025-07-23

CVE-2025-50481-Mezzanine CMS vulnerable to Cross-site Scripting

stephenmcd/mezzanine · GHSA-269j-37ww-cmh3

medium2025-07-23

CVE-2025-30086-Possible ORM Leak Vulnerability in the Harbor

goharbor/harbor · GHSA-h27m-3qw8-3pw8

high2025-07-23

CVE-2025-54365-FastAPI Guard has a regex bypass

rennf93/fastapi-guard · GHSA-rrf6-pxg8-684g

medium2025-07-23

CVE-2025-32019-Harbor repository description page has Cross-site Scripting vulnerability

goharbor/harbor · GHSA-f9vc-vf3r-pqqq

high2025-07-23

CVE-2025-8020-private-ip vulnerable to Server-Side Request Forgery

frenchbread/private-ip · GHSA-9h3q-32c7-r533

high2025-07-23

CVE-2025-8021-files-bucket-server vulnerable to Directory Traversal

dsilva2401/files-bucket-server · GHSA-3r3j-4vrw-884j

medium2025-07-22

CVE-2025-51471-Ollama vulnerable to Cross-Domain Token Exposure

ollama/ollama · GHSA-x9hg-5q6g-q3jr

medium2025-07-22

CVE-2025-51481-Dagster Local File Inclusion vulnerability

dagster-io/dagster · GHSA-h7x8-jv97-fvvm

medium2025-07-22

CVE-2025-51464-Aim vulnerable to Cross-site Scripting

aimhubio/aim · GHSA-gmvv-rj92-9w35

high2025-07-22

CVE-2025-53942-Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources

goauthentik/authentik · GHSA-9g4j-v8w5-7x42

high2025-07-22

CVE-2025-47281-Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service

kyverno/kyverno · GHSA-r5p3-955p-5ggq

medium2025-07-22

CVE-2025-7899-Powermail extension for TYPO3 allows Insecure Direct Object Reference

in2code-de/powermail · GHSA-x769-3cwv-f8hc

medium2025-07-22

CVE-2025-7900-Femanager extension for TYPO3 allows Insecure Direct Object Reference

in2code-de/femanager · GHSA-rc5f-3hfv-jxp2

high2025-07-21

CVE-2025-54140-`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write

pyload/pyload · GHSA-xqpg-92fq-grfg

medium2025-07-21

CVE-2025-54139-HAX CMS application pages vulnerable to clickjacking

haxtheweb/issues · GHSA-54vw-f4xf-f92j

high2025-07-21

CVE-2025-54138-LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE

librenms/librenms · GHSA-gq96-8w38-hhj2

high2025-07-21

CVE-2025-54137-NodeJS version of the HAX CMS application is distributed with Default Secrets

haxtheweb/issues · GHSA-5fpv-5qvh-7cf3

high2025-07-21

CVE-2025-54134-HAX CMS NodeJS Application Has Improper Error Handling That Leads to Denial of Service

haxtheweb/haxcms-nodejs · GHSA-pjj3-j5j6-qj27

high2025-07-21

CVE-2025-54128-NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting

haxtheweb/haxcms-nodejs · GHSA-59g8-h59f-8hjp

critical2025-07-21

CVE-2025-54127-NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access

haxtheweb/haxcms-nodejs · GHSA-f38f-jvqj-mfg6