Security advisories

medium2025-05-23

CVE-2025-48378-DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline

dnnsoftware/dnn.platform · GHSA-m4hf-fxcg-cp34

medium2025-05-23

CVE-2025-48377-Reflected Cross-Site Scripting (XSS) in module actions in edit mode

dnnsoftware/dnn.platform · GHSA-79m3-rvx2-3qq9

low2025-05-23

CVE-2025-48376-DNN site Import could use an external source with a crafted request

dnnsoftware/dnn.platform · GHSA-62mf-vhhw-xmf8

medium2025-05-23

CVE-2018-25110-Marked allows Regular Expression Denial of Service (ReDoS) attacks

markedjs/marked · GHSA-p9wx-2529-fp83

medium2025-05-22

CVE-2025-48374-zot logs secrets

project-zot/zot · GHSA-c37v-3c8w-crq8

high2025-05-22

CVE-2025-48075-Fiber panics when fiber.Ctx.BodyParser parses invalid range index

gofiber/fiber · GHSA-hg3g-gphw-5hhm

high2025-05-22

CVE-2025-4123-Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin

grafana/grafana · GHSA-q53q-gxq9-mgrj

medium2025-05-21

CVE-2025-4949-Eclipse JGit XML External Entity (XXE) Vulnerability

eclipse-jgit/jgit · GHSA-vrpq-qp53-qv56

high2025-05-21

CVE-2025-48201-The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location

nitsan-technologies/ns_backup · GHSA-hq4f-5qjv-fwrg

low2025-05-21

CVE-2025-5030-Ackites KillWxapkg vulnerable to OS Command Injection

ackites/killwxapkg · GHSA-w6p4-84vc-qc2w

low2025-05-21

CVE-2025-5031-Ackites KillWxapkg Zip Bomb Resource Exhaustion

ackites/killwxapkg · GHSA-pqqp-7cp8-vxvf

low2025-05-21

CVE-2025-48206-The Backup Plus extension for TYPO3 (ns_backup) allows XSS

nitsan-technologies/ns_backup · GHSA-xg53-mhh9-3cq7

medium2025-05-21

CVE-2025-48204-The Backup Plus extension for TYPO3 (ns_backup) allows command injections

nitsan-technologies/ns_backup · GHSA-463c-jhp2-4mm7

medium2025-05-21

CVE-2025-48069-Insufficient input sanitization in ejson2env

shopify/ejson2env · GHSA-2c47-m757-32g6

medium2025-05-21

CVE-2025-48063-XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right

xwiki/xwiki-platform · GHSA-rhfv-688c-p6hp

medium2025-05-21

CVE-2025-48207-reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference

kephson/reint_downloadmanager · GHSA-jjwh-4x89-7f5w

medium2025-05-21

CVE-2025-47291-containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.

containerd/containerd · GHSA-cxfp-7pvr-95ff

medium2025-05-21

CVE-2025-48202-The femanager TYPO3 extension allows Insecure Direct Object Reference

in2code-de/femanager · GHSA-xxwr-wv9g-7jw3

medium2025-05-21

CVE-2025-48203-[clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability

clickstorm/cs_seo · GHSA-6p8w-pc35-mqv8

medium2025-05-21

CVE-2025-48056-Character injection in Hubble CLI

cilium/hubble · GHSA-274q-79q9-52j7