Security advisories

low2025-02-24

CVE-2025-26532-Moodle allows teachers to evade trusttext config when restoring glossary entries

moodle/moodle · GHSA-cw24-f6fq-7j9v

medium2025-02-24

CVE-2025-26527-Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block

moodle/moodle · GHSA-5r85-6h7f-rg3r

high2025-02-24

CVE-2025-26530-Moodle allows reflected XSS via question bank filter

moodle/moodle · GHSA-4w32-c9g7-27qx

high2025-02-24

CVE-2025-26525-Moodle has an arbitrary file read risk through pdfTeX

moodle/moodle · GHSA-4hmr-39vp-xfrr

high2025-02-24

Better Auth allows bypassing the trustedOrigins Protection which leads to ATO

better-auth/better-auth · GHSA-vp58-j275-797x

medium2025-02-24

CVE-2025-26803-Phusion Passenger denial of service

phusion/passenger · GHSA-2cj2-qqxj-5m3r

medium2025-02-24

CVE-2025-27143-Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

better-auth/better-auth · GHSA-hjpm-7mrm-26w8

high2025-02-24

OpenH264 Rust API Openh264 Decoding Functions Heap Overflow Vulnerability

ralfbiedert/openh264-rs · GHSA-5pmw-9j92-3c4c

medium2025-02-24

CVE-2025-24526-Mattermost fails to restrict channel export of archived channels

mattermost/mattermost · GHSA-q8p2-2hwc-jw64

critical2025-02-24

CVE-2025-25279-Mattermost allows reading arbitrary files related to importing boards

mattermost/mattermost · GHSA-5fwx-p6xh-vjrh

critical2025-02-24

CVE-2025-20051-Mattermost allows reading arbitrary files

mattermost/mattermost · GHSA-v469-7wp6-7cvp

low2025-02-24

CVE-2025-1412-Mattermost fails to invalidate all active sessions when converting a user to a bot

mattermost/mattermost · GHSA-rhvr-6w8c-6v7w

low2025-02-23

CVE-2025-1467-tarteaucitron Cross-site Scripting (XSS)

amauric/tarteaucitron.js · GHSA-8wp9-x25p-8794

medium2025-02-23

CVE-2025-1584-Solon Path Traversal

opensolon/solon · GHSA-x8q6-cchr-p7m6

low2025-02-21

Leantime allows Cross-Site Scripting (XSS)

leantime/leantime · GHSA-f679-254h-qhvj

medium2025-02-21

CVE-2025-28254-Leantime affected by Improper Neutralization of HTML Tags

leantime/leantime · GHSA-95j3-435g-vjcp

low2025-02-21

Leantime has Missing Authorization Check for Host Parameter

leantime/leantime · GHSA-3hfj-qcvj-4hx8

medium2025-02-21

CVE-2025-26623-Exiv2 allows Use After Free

exiv2/exiv2 · GHSA-38h4-fx85-qcx7

high2025-02-21

Leantime allows Stored Cross-Site Scripting (XSS)

leantime/leantime · GHSA-c39w-3pjx-qc7m

medium2025-02-21

Leantime allows Cross-Site Request Forgery (CSRF)

leantime/leantime · GHSA-92xh-6x7v-4rmq