Security advisories

medium2025-06-20

CVE-2025-71405-chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

go-chi/chi · GHSA-vrw8-fxc6-2r93

medium2025-06-20

CVE-2025-3227-Mattermost allows unauthorized channel member management through playbook runs

mattermost/mattermost · GHSA-qwwm-c582-82rx

medium2025-06-20

CVE-2025-3228-Mattermost allows an unauthorized Guest user access to Playbook

mattermost/mattermost · GHSA-4578-6gjh-f2jm

high2025-06-20

CVE-2025-52488-DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input

dnnsoftware/dnn.platform · GHSA-mgfv-2362-jq96

high2025-06-20

CVE-2025-52487-DNN.PLATFORM possibly allows bypass of IP Filters

dnnsoftware/dnn.platform · GHSA-fjhg-3mrh-mm7h

medium2025-06-20

CVE-2025-52485-DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

dnnsoftware/dnn.platform · GHSA-wwc9-wmm3-2pmf

medium2025-06-20

CVE-2025-52486-DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects

dnnsoftware/dnn.platform · GHSA-pf4h-vrv6-cmvr

high2025-06-20

sentry-android unmasked sensitive data in Android Session Replays for users of Jetpack Compose 1.8+

getsentry/sentry-java · GHSA-7cjh-xx4r-qh3f

critical2025-06-20

CVE-2025-4981-Mattermost allows authenticated users to write files to arbitrary locations

mattermost/mattermost · GHSA-qh58-9v3j-wcjc

medium2025-06-20

CVE-2025-6264-Velociraptor vulnerable to privilege escalation via UpdateConfig artifact

velocidex/velociraptor · GHSA-gpfc-mph4-qm24

high2025-06-19

CVE-2025-6384-Crafter Studio Groovy Sandbox Bypass

craftercms/studio · GHSA-5644-3vgq-2ph5

low2025-06-19

CVE-2025-6279-Upsonic has vulnerability in Pickle Handler component that can lead to deserialization

upsonic/upsonic · GHSA-rpfv-46xj-5984

low2025-06-19

CVE-2025-6278-Upsonic is vulnerable to Path Traversal attack through its os.path.join function

upsonic/upsonic · GHSA-8jf4-fcjr-68c2

critical2025-06-19

CVE-2025-49132-Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

pterodactyl/panel · GHSA-24wv-6c99-f843

low2025-06-19

CVE-2025-6272-pywasm3 has Improper Restriction of Operations within the Bounds of a Memory Buffer

wasm3/pywasm3 · GHSA-rrmw-gv85-w824

low2025-06-19

CVE-2025-48059-PowSyBl Core Contains a Polynomial ReDoS in RegexCriterion

powsybl/powsybl-core · GHSA-8qjw-9xgm-c9ff

medium2025-06-19

CVE-2025-48058-PowSyBl Core contains Polynomial REDoS’es

powsybl/powsybl-core · GHSA-rqpx-f6rc-7hm5

high2025-06-19

CVE-2025-47771-PowSyBl Core allows deserialization of untrusted SparseMatrix data

powsybl/powsybl-core · GHSA-f5cx-h789-j959

high2025-06-19

DotVVM allows path traversal when deployed in Debug mode

riganti/dotvvm · GHSA-6q65-j4jw-9cg8

low2025-06-19

CVE-2025-47293-PowSyBl Core XML Reader allows XXE and SSRF

powsybl/powsybl-core · GHSA-qpj9-qcwx-8jv2