GHSA-GPX4-37G2-C8PV Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

Summary In the default configuration, webhook.azuredevops.username and webhook.azuredevops.password not set, Argo CD’s /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index 0 is...

Improper Validation of Function Hook Arguments

Overview Affected versions of this package are vulnerable to Improper Validation of Function Hook Arguments in the /api/webhook endpoint via the affectedRevisionInfo function. An attacker can cause the server process to crash and disrupt service availability by sending a Gogs push event whose JSO...

Improper Validation of Function Hook Arguments

Overview Affected versions of this package are vulnerable to Improper Validation of Function Hook Arguments in the /api/webhook endpoint via the affectedRevisionInfo function. An attacker can cause the server process to crash and disrupt service availability by sending a Gogs push event whose JSO...

CVE-2025-35033

creationtimestamp| type| source ---|---|--- 2025-09-30 16:57:49+00:00| seen| Telegram/3221ls20U9KWC9GIxhjuBqnB1fjXR72e8-23Mlp2EvsslX4...

CVE-2025-57852

creationtimestamp| type| source ---|---|--- 2025-09-30 14:59:45+00:00| seen| Telegram/tzVVVEZnRF-Acx-BoJjqTYV8V4SsWMswzNbeAD4WdU506s...

CVE-2025-41096

creationtimestamp| type| source ---|---|--- 2025-09-30 11:57:22+00:00| seen| Telegram/k-hsExMdK7MlhRvGPWfqe4x8ErpIQIEBpDYc0n-EFAiD4I...

CVE-2025-8877

creationtimestamp| type| source ---|---|--- 2025-09-30 08:58:19+00:00| seen| Telegram/J8TUttA5kk0ABEFeJuro2Gq3q2xQ3WcyoUJ7BaGSufGbsQ4...

CVE-2025-11163

creationtimestamp| type| source ---|---|--- 2025-09-30 05:59:32+00:00| seen| Telegram/jblmDzS4h1AZ2WyXVALmPQWKCiUiERYwsgx9N6NiDmw-Rs...

CVE-2025-8214

creationtimestamp| type| source ---|---|--- 2025-09-30 03:58:33+00:00| seen| Telegram/7otDent9Ig63b1UGGHA75F-J48qvL87fzYX0UJKMptQlpoE...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS when inviting users to an event. An attacker can execute arbitrary web script or inject HTML by supplying crafted input into the First Name, Middle text, or Last Name fields. Details Cross-site scripting or XSS ...

GHSA-PF86-4W35-CJ89 Liferay Portal vulnerable to cross-site scripting in the Calendar widget

Multiple cross-site scripting XSS vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allo...

Liferay Portal vulnerable to cross-site scripting in the Calendar widget

Multiple cross-site scripting XSS vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allo...

CVE-2025-59948

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication setting needs to ...

CVE-2025-57878

creationtimestamp| type| source ---|---|--- 2025-09-29 18:58:42+00:00| seen| Telegram/g4nNY8IQP8JMFwK51h2FMchAXivEjh6CugNCeld92VjTeI0...

CVE-2025-57874

creationtimestamp| type| source ---|---|--- 2025-09-29 18:58:39+00:00| seen| Telegram/uDB0hyBSK2evk5Zo03dtoPTpqeBWhcqqv3G9evqNKjHKZAs...

CVE-2025-60096

creationtimestamp| type| source ---|---|--- 2025-09-29 17:01:16+00:00| seen| Telegram/ekBUGq4CNXut3VrGAQReDbswt7QXZnWt7NlDBxLVaWPqt24...

CVE-2025-11155

creationtimestamp| type| source ---|---|--- 2025-09-29 15:58:42+00:00| seen| Telegram/oemz4rrMjPkoti7Y-Cnq1L4zOaNi0dGKYbmpCBhBwvbWM1s...

CVE-2025-10346

creationtimestamp| type| source ---|---|--- 2025-09-29 08:59:24+00:00| seen| Telegram/TBw3prpN5euFqDMO3FIfit9GEDDpRFp4C2uazUa0OFrWeg...

Security Bulletin:IBM Event Endpoint Management is vulnerable to Sensitive Information Leakage and Request Smuggling (CVE-2025-4673,CVE-2025-22871)

Summary Operator of IBM Event Endpoint Management is vulnerable to Sensitive Information Leakage and Request Smuggling due to apache HTTP pomponents. IBM Event Endpoint Management uses HTTP components to expose secure event APIs via its Event Gateway, enabling client applications to interact with...

Security Bulletin: IBM Event Endpoint Management is vulnerable to Remote Code Execution and Server-Side Request Forgery attacks (CVE-2025-27818,CVE-2025-27817)

Summary Operator of IBM Event Endpoint Management is vulnerable to remote code execution and server-side request forgery due to unsafe deserialization and misconfigured OAuthBearer endpoints in SASL JAAS configuration. Vulnerability Details CVEID:CVE-2025-27818 DESCRIPTION: A possible security...