Security advisories

medium2025-04-18

CVE-2024-41447-Alkacon OpenCMS stored cross-site scripting (XSS) vulnerability

alkacon/opencms-core · GHSA-vq95-6x79-qv8j

critical2025-04-18

CVE-2025-29953-Apache ActiveMQ NMS OpenWire Client Deserialization of Untrusted Data vulnerability

apache/activemq-nms-openwire · GHSA-9g64-r942-fvmp

critical2025-04-18

CVE-2025-32434-PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

pytorch/pytorch · GHSA-53q9-r3pm-6pq6

high2025-04-18

CVE-2025-32792-ses's global contour bindings leak into Compartment lexical scope

endojs/endo · GHSA-h9w6-f932-gq62

high2025-04-18

CVE-2025-32442-Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass

fastify/fastify · GHSA-mg2h-6x62-wpwc

high2025-04-17

CVE-2024-53924-Pycel allows code injection via a crafted formula

stephenrauch/pycel · GHSA-pw67-xjhq-389w

high2025-04-17

CVE-2024-55238-OpenMetadata SQL Injection

open-metadata/openmetadata · GHSA-x8pm-wrg2-mqmx

medium2025-04-17

CVE-2025-3760-Liferay Cross-site Scripting vulnerability

liferay/liferay-portal · GHSA-qhp6-vp7c-g7xp

medium2025-04-17

CVE-2025-43717-PEAR HTTP_Request2 vulnerable to Cross-site Scripting

pear/http_request2 · GHSA-w7gh-f2fm-9q8r

medium2025-04-16

CVE-2025-3730-PyTorch Improper Resource Shutdown or Release vulnerability

pytorch/pytorch · GHSA-887c-mr87-cxwp

high2025-04-16

CVE-2024-53305-Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

benbusby/whoogle-search · GHSA-2689-cw26-6cpj

medium2025-04-16

CVE-2025-2564-Mattermost Incorrect Authorization vulnerability

mattermost/mattermost · GHSA-mj2p-v2c2-vh4v

medium2025-04-16

CVE-2025-32791-Permission policy information leakage in Backstage permission system

backstage/backstage · GHSA-f8j4-p5cr-p777

medium2025-04-16

CVE-2025-32783-Unregistered users can see "public" messages from a closed wiki via notifications from a different wiki

xwiki/xwiki-platform · GHSA-42fh-pvvh-999x

low2025-04-16

CVE-2025-31363-Mattermost doesn't restrict domains LLM can request to contact upstream

mattermost/mattermost · GHSA-9h6j-4ffx-cm84

medium2025-04-16

CVE-2025-27936-Mattermost vulnerable to Observable Timing Discrepancy

mattermost/mattermost · GHSA-2j87-p623-8cc2

low2025-04-16

CVE-2025-24839-Mattermost Incorrect Authorization vulnerability

mattermost/mattermost · GHSA-j639-m367-75cf

low2025-04-16

CVE-2025-27538-Mattermost Missing Authentication for Critical Function

mattermost/mattermost · GHSA-j5jw-m2ph-3jjf

medium2025-04-16

CVE-2025-27571-Mattermost Incorrect Authorization vulnerability

mattermost/mattermost · GHSA-h4rr-f37j-4hh7

critical2025-04-15

CVE-2025-30215-NATS Server may fail to authorize certain Jetstream admin APIs

nats-io/nats-server · GHSA-fhg8-qxh5-7q3w