Security advisories

medium2025-07-16

CVE-2024-9343-Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console

eclipse-ee4j/glassfish · GHSA-mqxx-c43h-jj9v

medium2025-07-16

CVE-2024-10031-Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications

eclipse-ee4j/glassfish · GHSA-hp97-5x6g-q538

medium2025-07-16

CVE-2024-9342-Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts

eclipse-ee4j/glassfish · GHSA-99f7-hp6j-v6q4

medium2025-07-16

CVE-2024-10032-Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console

eclipse-ee4j/glassfish · GHSA-62g9-99m7-w8wv

medium2025-07-16

CVE-2025-22227-Reactor Netty HTTP is vulnerable to credential leaks during chained redirects

reactor/reactor-netty · GHSA-4q2v-9p7v-3v22

medium2025-07-15

CVE-2025-53622-DSpace is vulnerable to Path Traversal attacks when importing packages using Simple Archive Format

dspace/dspace · GHSA-vhvx-8xgc-99wf

medium2025-07-15

CVE-2025-53621-DSpace is vulnerable to XML External Entity injection during archive imports

dspace/dspace · GHSA-jjwr-5cfh-7xwh

high2025-07-15

CVE-2025-53818-GitHub Kanban MCP Server vulnerable to Command Injection

sunwood-ai-labs/github-kanban-mcp-server · GHSA-6jx8-rcjx-vmwf

critical2025-07-15

CVE-2025-53890-pyLoad vulnerable to XSS through insecure CAPTCHA

pyload/pyload · GHSA-8w3f-4r8f-pf53

medium2025-07-15

CVE-2025-53889-Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows

directus/directus · GHSA-7cvf-pxgp-42fc

medium2025-07-15

Measured is vulnerable to Path Traversal attacks during class initialization

shopify/measured · GHSA-29g5-m8v7-v564

medium2025-07-15

CVE-2025-48795-Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged

apache/cxf · GHSA-36wv-v2qp-v4g4

high2025-07-15

CVE-2025-6965-SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite

ericsink/sqlitepcl.raw · GHSA-2m69-gcr7-jv3q

medium2025-07-15

CVE-2025-53887-Directus' exact version number is exposed by the OpenAPI Spec

directus/directus · GHSA-rmjh-cf9q-pv7q

medium2025-07-15

CVE-2025-53886-Directus tokens are not redacted in flow logs, exposing session credentials to all admin

directus/directus · GHSA-f24x-rm6g-3w5v

medium2025-07-15

CVE-2025-53885-Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged

directus/directus · GHSA-x3vm-88hf-gpxp

medium2025-07-15

CVE-2025-24294-resolv vulnerable to DoS via insufficient DNS domain name length validation

ruby/resolv · GHSA-xh69-987w-hrp8

critical2025-07-14

CVE-2025-53836-XWiki Rendering is vulnerable to RCE attacks when processing nested macros

xwiki/xwiki-rendering · GHSA-32mf-57h2-64x9

critical2025-07-14

CVE-2025-53835-XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax

xwiki/xwiki-rendering · GHSA-w3wh-g4m9-783p

critical2025-07-14

CVE-2025-53833-LaRecipe is vulnerable to Server-Side Template Injection attacks

saleem-hadad/larecipe · GHSA-jv7x-xhv2-p5v2