dify security vulnerabilities

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in dify v1.0, which stems from a server-side request forgery in the component controllers.console.remotefiles.RemoteFileUploadApi...

Echo security vulnerability

Echo is an open source community system with no separation of front and back end for Veal98 individual developers. A security vulnerability exists in Echo version 4.2, which stems from an improper authorization issue in the documentation...

YzmCMS Cross-Site Scripting Vulnerability

YzmCMS is an open source CMS Content Management System. A cross-site scripting vulnerability exists in YzmCMS. The vulnerability stems from improper handling of the gourl parameter in message.tpl, which can be exploited by attackers to cause cross-site scripting attacks...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2025-932)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-932 advisory. A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory...

[SECURITY] Fedora 40 Update: chromium-135.0.7049.84-1.fc40

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 41 Update: chromium-135.0.7049.84-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 42 Update: chromium-135.0.7049.52-2.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 42 Update: firefox-137.0-2.fc42

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Security Bulletin: IBM Aspera Desktop App has multiple vulnerabilities related to Open Source dependencies (CVE-2025-27789 and CVE-2025-24010 )

Summary IBM Aspera Desktop App is affected by inefficient regular expression complexity which can cause excessive CPU cycles and lack of validation on the Origin header which could cause an unauthorized access to any functionality accessible to the communication source. These vulnerabilities have...

Top security talks from KubeCon Europe 2025

Many of the talks at KubeCon Europe, Europe’s largest open source community conference, were related to security. Let's discuss some of our favorites...

Rancher Information Leakage Vulnerability

Rancher is an open source container management platform from Rancher Open Source in the United States, built for organizations that deploy containers in production environments. Rancher suffers from an information disclosure vulnerability that stems from the disclosure of sensitive information to...

Linux Distros Unpatched Vulnerability : CVE-2024-37302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce...

CVE-2025-32027

Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher...

CVE-2025-32382 Snowflake credentials logged by the Metabase backend

Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase either updating a password or changing password to private key or vice versa, Metabase would not always purge older Snowflake connection details from the...

CVE-2025-32383 MaxKB has a reverse shell vulnerability in function library

MaxKB Max Knowledge Base is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation RAG. A reverse shell vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to create a reverse shell...

CVE-2025-32383 MaxKB has a reverse shell vulnerability in function library

MaxKB Max Knowledge Base is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation RAG. A reverse shell vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to create a reverse shell...

FusionDIrectory security vulnerability

FusionDIrectory is a FusionDIrectory open source application. It is used to secure your identity management. A security vulnerability exists in FusionDIrectory versions prior to 1.5 that stems from a path traversal that could lead to reading arbitrary files...

CVE-2025-32373

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This vulnerability is fixed in 9.13.8...

CVE-2025-32378

Shopware CVE-2025-32378 affects Shopware open source platforms prior to 6.6.10.3 and 6.5.8.17, where default double-opt-in newsletter settings allow mass sign-ups without confirmation. With Newsletter: Double Opt-in active and related disabled options, anyone can register using any email and opt ...

CVE-2025-32374 Possible Denial of Service (DoS) in DNN.PLATFORM registration

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Possible denial of service with specially crafted information in the public registration form. This vulnerability is fixed in 9.13.8...