Security advisories

high2025-06-16

CVE-2025-3594-Liferay Portal path traversal vulnerability with the downloading and installation of Xuggler

liferay/liferay-portal · GHSA-p73j-gpcq-49h8

high2025-06-16

CVE-2025-3526-Liferay Portal SessionClicks does not restrict the saving of request parameters in the HTTP session

liferay/liferay-portal · GHSA-mf3r-6m25-3867

high2025-06-16

CVE-2025-48988-Apache Tomcat - DoS in multipart upload

apache/tomcat · GHSA-h3gc-qfqq-6h8f

medium2025-06-16

CVE-2025-49124-Apache Tomcat installer for Windows has an untrusted search path vulnerability

apache/tomcat · GHSA-42wg-hm62-jcwg

high2025-06-16

CVE-2025-3602-Liferay Portal does not limit the depth of a GraphQL queries

liferay/liferay-portal · GHSA-8c26-xm99-53w7

low2025-06-16

CVE-2025-49134-Weblate exposes personal IP address via e-mail

weblateorg/weblate · GHSA-4qqf-9m5c-w2c5

medium2025-06-16

CVE-2025-47951-Weblate lacks rate limiting when verifying second factor

weblateorg/weblate · GHSA-57jg-m997-cx3q

critical2025-06-13

CVE-2025-49596-MCP Inspector proxy server lacks authentication between the Inspector client and proxy

modelcontextprotocol/inspector · GHSA-7f8r-222p-6f5g

low2025-06-13

CVE-2025-49597-handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution

handcraftedinthealps/goodby-csv · GHSA-x3c7-22c8-prg7

high2025-06-13

CVE-2025-49585-XWiki does not require right warnings for XClass definitions

xwiki/xwiki-platform · GHSA-59w6-r9hm-439h

high2025-06-13

CVE-2025-49586-XWiki allows remote code execution through preview of XClass changes in AWM editor

xwiki/xwiki-platform · GHSA-jp4x-w9cj-97q7

medium2025-06-13

CVE-2025-49587-XWiki does not require right warnings for notification displayer objects

xwiki/xwiki-platform · GHSA-j7p2-87q3-44w7

high2025-06-13

CVE-2025-49584-XWiki makes title of inaccessible pages available through the class property values REST API

xwiki/xwiki-platform · GHSA-mvp5-qx9c-c3fv

medium2025-06-13

CVE-2025-49583-XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right

xwiki/xwiki-platform · GHSA-ff6v-w58f-v97w

high2025-06-13

CVE-2025-49581-XWiki allows remote code execution through default value of wiki macro wiki-type parameters

xwiki/xwiki-platform · GHSA-9875-cw22-f7cx

high2025-06-13

CVE-2025-49582-XWiki's required right warnings for macros are incomplete

xwiki/xwiki-platform · GHSA-c32m-27pj-4xcj

high2025-06-13

CVE-2025-49580-XWiki allows privilege escalation through link refactoring

xwiki/xwiki-platform · GHSA-jm43-hrq7-r7w6

critical2025-06-13

CVE-2025-28384-OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint

openc3/cosmos · GHSA-p67j-387g-75wc

medium2025-06-13

CVE-2025-46096-Solon Vulnerable to Directory Traversal

opensolon/solon · GHSA-m63q-4hr8-5r5h

high2025-06-13

CVE-2025-28382-OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint

openc3/cosmos · GHSA-cf8v-5mrc-jv7f