Security advisories

medium2025-04-09

CVE-2025-31672-Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing

apache/poi · GHSA-gmg8-593g-7mv3

high2025-04-09

CVE-2025-29189-Flowise Vulnerable to SQL Injection via `tableName` Parameter

flowiseai/flowise · GHSA-gjx9-wg9x-7gvp

medium2025-04-08

CVE-2025-27191-Magento Improper Access Control leads to Security feature bypass

magento/magento2 · GHSA-vhcq-4xrm-2cr2

medium2025-04-08

CVE-2025-27188-Magento Improper Authorization vulnerability

magento/magento2 · GHSA-rr2g-rrjj-xw86

medium2025-04-08

CVE-2025-27190-Magento Improper Access Control leads to Security feature bypass

magento/magento2 · GHSA-6wq7-cg9h-mj6q

low2025-04-08

CVE-2025-27192-Magento does not properly protect credentials

magento/magento2 · GHSA-2r94-wm5v-4prx

critical2025-04-08

CVE-2025-22871-RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency

roadrunner-server/roadrunner · GHSA-g9pc-8g42-g6vq

high2025-04-08

CVE-2025-25227-Joomla CMS Multi-Factor Authentication Bypass

joomla/joomla-cms · GHSA-6423-85cc-8gf6

medium2025-04-08

CVE-2024-52981-Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion

elastic/elasticsearch · GHSA-5xm9-x7x4-4j5x

medium2025-04-08

CVE-2025-25226-Joomla Framework Database Package Vulnerable to SQL Injection

joomla-framework/database · GHSA-44v2-prcf-pc3m

medium2025-04-08

CVE-2024-52980-Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function

elastic/elasticsearch · GHSA-ghfh-p92w-j4mg

medium2025-04-08

Lemmy user purging users or communities or banning users can delete images they didn't upload/exclusively use

lemmynet/lemmy · GHSA-wr2m-38xh-rpc9

medium2025-04-08

Shopware Broken ACL on Document retrieval to access other customers documents

shopware/shopware · GHSA-68wv-g3fw-pq7q

high2025-04-08

CVE-2025-27892-Shopware Vulnerable to Blind SQL-injection in DAL aggregations

shopware/shopware · GHSA-8g35-7rmw-7f59

low2025-04-08

CVE-2025-30166-Pimcore's Admin Classic Bundle allows HTML Injection

pimcore/admin-ui-classic-bundle · GHSA-x82r-6j37-vrgg

high2025-04-08

CVE-2025-30151-Shopware allows Denial Of Service via password length

shopware/shopware · GHSA-cgfj-hj93-rmh2

medium2025-04-08

CVE-2025-30150-Shopware 6 allows attackers to check for registered accounts through the store-api

shopware/shopware · GHSA-hh7j-6x3q-f52h

low2025-04-07

Tokio broadcast channel calls clone in parallel, but does not require `Sync`

tokio-rs/tokio · GHSA-rr8g-9fpq-6wmg

medium2025-04-07

CVE-2025-32029-ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation

apeleghq/ts-asn1-der · GHSA-p4qw-7j9g-5h53

medium2025-04-07

CVE-2025-71351-Picklescan missing detection when calling built-in python library function timeit.timeit()

mmaitre314/picklescan · GHSA-v7x6-rv5q-mhwc