{"generatedAt":"2026-10-28T12:00:08+00:00","sourceDetails":[{"id":"github-advisories","name":"GitHub Security Advisories (GHSA)","url":"https:\/\/github.com\/advisories","count":1389},{"id":"cisa-kev","name":"CISA Known Exploited Vulnerabilities","url":"https:\/\/www.cisa.gov\/sites\/default\/files\/feeds\/known_exploited_vulnerabilities.json","count":2}],"advisories":[{"id":"GHSA-m65p-9j7q-6w33","title":"MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source","aliases":["CVE-2026-116690"],"summary":"### Summary\nOn MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server\u2019s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path.\n\nThe fix ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mlflow","publishedAt":"2026-10-27T21:26:56Z","exploitedKev":false,"fixedVersion":"3.17.0","vulnerableRange":">= 3.10.0 < 3.17.0"},{"id":"GHSA-26p8-2jq9-3vq9","title":"MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules","aliases":["CVE-2026-116692"],"summary":"## Summary\n\nMLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtain","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mlflow","publishedAt":"2026-10-27T21:26:32Z","exploitedKev":false,"fixedVersion":"3.17.0","vulnerableRange":">= 3.12.0rc0 < 3.17.0"},{"id":"GHSA-x94g-w73q-hpcw","title":"dd-trace: ReDOS in URL query string obfuscation","aliases":["CVE-2026-116693"],"summary":"### Summary\n\nA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations.\n\n### Details\n","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"dd-trace","publishedAt":"2026-10-27T21:07:25Z","exploitedKev":false,"fixedVersion":"5.131.1","vulnerableRange":">= 2.0.0 < 5.131.1"},{"id":"GHSA-mf2p-h6hf-fcwm","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization","aliases":["CVE-2026-116675"],"summary":"### Impact\nStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled.\n\n### Patches\nThi","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"tinymce","publishedAt":"2026-10-27T21:07:12Z","exploitedKev":false,"fixedVersion":"8.9.3","vulnerableRange":">= 8.5.1 < 8.9.3"},{"id":"GHSA-rh54-vffm-5fvp","title":"CKEditor: Cross-site scripting (XSS) in the engine package","aliases":["CVE-2026-116688"],"summary":"### Impact\nA Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the `es-toolkit` library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript co","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ckeditor5","publishedAt":"2026-10-27T21:05:06Z","exploitedKev":false,"fixedVersion":"47.7.4","vulnerableRange":">= 45.0.0 < 47.7.4"},{"id":"GHSA-rjh2-4xgw-p2hj","title":"Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan","aliases":["CVE-2026-116676"],"summary":"### Summary\n\nAtlantis passes the Terraform `workspace` value from a pull request's `atlantis.yaml` into a shell command without quoting or escaping it.\n\nA contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and ex","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/runatlantis\/atlantis","publishedAt":"2026-10-27T21:04:50Z","exploitedKev":false,"fixedVersion":"0.47.1","vulnerableRange":">= 0.4.0 <= 0.47.0"},{"id":"GHSA-mgqf-5mf5-prfj","title":"FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory","aliases":["CVE-2026-116682"],"summary":"## Summary\n\nFile read paths resolve symbolic links with `filepath.EvalSymlinks` and then operate on the resolved target without re-checking that the target still lies inside the user's source\/scope. \n\nA symlink located inside a user's accessible directory that points outside the ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/gtsteffaniak\/filebrowser\/backend","publishedAt":"2026-10-27T21:04:40Z","exploitedKev":false,"fixedVersion":"0.0.0-20260814233832-4126edeb07a0","vulnerableRange":"< 0.0.0-20260814233832-4126edeb07a0"},{"id":"GHSA-4w7w-5xrc-9h26","title":"undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects","aliases":["CVE-2026-109829"],"summary":"### Impact\n\nWhen an originless `Agent` composes the redirect and cache interceptors as `compose(redirect(), cache())` with a shared cache (`type: 'shared'`), the cache builds its key from the original request URL before the redirect handler changes the origin. The response produc","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"undici","publishedAt":"2026-10-27T19:02:31Z","exploitedKev":false,"fixedVersion":"7.30.1","vulnerableRange":">= 7.0.0 < 7.30.1"},{"id":"GHSA-2m5v-pch6-74hx","title":"undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent","aliases":["CVE-2026-109383"],"summary":"### Impact\n\nundici's `Agent` passes its constructor options through a JSON-based deep clone (`JSON.parse(JSON.stringify(...))`) before forwarding them to each per-origin `Pool`. JSON cannot represent functions, so a caller-supplied `tls` option containing a `checkServerIdentity` ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"undici","publishedAt":"2026-10-27T19:02:26Z","exploitedKev":false,"fixedVersion":"6.29.1","vulnerableRange":">= 4.0.0 < 6.29.1"},{"id":"GHSA-qrxm-fqhp-jwvm","title":"undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation","aliases":["CVE-2026-87018"],"summary":"## Impact\n\nundici crashes the client process when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handsha","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"undici","publishedAt":"2026-10-27T19:02:21Z","exploitedKev":false,"fixedVersion":"6.29.1","vulnerableRange":">= 4.2.1 < 6.29.1"},{"id":"GHSA-f897-62hf-6gxq","title":"MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length","aliases":[],"summary":"### Summary\nIn affected versions, MCP servers reachable over HTTP put no limit on the size of a POST body or on the number of messages in a JSON-RPC batch. Large requests could exhaust the server's memory, and one long batch could block it from serving anyone else. No credentials","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@modelcontextprotocol\/sdk","publishedAt":"2026-10-27T19:02:00Z","exploitedKev":false,"fixedVersion":"1.30.1","vulnerableRange":">= 1.10.0 < 1.30.1"},{"id":"GHSA-2v3c-qxhr-7vpv","title":"Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process","aliases":["CVE-2026-109413"],"summary":"### Description\n\n`Yaml\\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nesting level that the rest of the parser bounds with `maxNestingLevel`. A document made of dee","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"symfony\/symfony","publishedAt":"2026-10-27T19:01:50Z","exploitedKev":false,"fixedVersion":"5.4.54","vulnerableRange":">= 2.0.0 < 5.4.54"},{"id":"GHSA-r925-mgvr-h9cc","title":"Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header","aliases":["CVE-2026-108082"],"summary":"### Description\n\n`HeaderUtils::split()` parsed header values with a pattern whose token alternative also matched whitespace, followed by a `(?<!\\s)` lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in expo","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"symfony\/http-foundation","publishedAt":"2026-10-27T19:01:39Z","exploitedKev":false,"fixedVersion":"6.4.46","vulnerableRange":">= 6.0.1 < 6.4.46"},{"id":"GHSA-mgcc-cww5-fp2q","title":"Go JOSE: DoS when parsing JWKs that contain RSA keys","aliases":["CVE-2026-116587"],"summary":"### Summary\n\nA crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU.\n\n### Details\n\ngo-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to `crypto\/rsa.PrivateKey.Validate()`. On Go 1.24+,","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/go-jose\/go-jose\/v4","publishedAt":"2026-10-27T19:01:30Z","exploitedKev":false,"fixedVersion":"4.1.6","vulnerableRange":"<= 4.1.5"},{"id":"GHSA-vg84-c5mg-76xh","title":"CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values","aliases":["CVE-2026-116683"],"summary":"### Impact\n\nCTFer.io's CTFd Terraform Provider stores `ctfd_team.password` as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.\n\n### Patches\n\nPatc","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/ctfer-io\/terraform-provider-ctfd","publishedAt":"2026-10-27T19:00:50Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.1.5 <= 1.1.0"},{"id":"GHSA-wf6j-7hvr-gr93","title":"Hydra legacy target blacklist permits unsafe PyYAML loading","aliases":[],"summary":"## Summary\n\nHydra's legacy target blacklist omits PyYAML's unsafe loading surfaces. If an\napplication passes attacker-controlled targets and arguments to instantiate(),\na target such as yaml.unsafe_load can execute Python code through a\nconfig-controlled YAML stream containing Py","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"hydra-core","publishedAt":"2026-10-27T17:08:41Z","exploitedKev":false,"fixedVersion":"1.3.8","vulnerableRange":">= 1.3.6 < 1.3.8"},{"id":"GHSA-qq8j-7v2v-3rwp","title":"undici WebSocket client vulnerable to Denial of Service via failed HTTP\/2 handshake","aliases":["CVE-2026-109855"],"summary":"### Impact\n\nundici's experimental WebSocket client (enabled by default via `allowH2: true`) crashes the Node.js process when it connects to a malicious server over HTTP\/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts t","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"undici","publishedAt":"2026-10-27T16:09:45Z","exploitedKev":false,"fixedVersion":"8.11.2","vulnerableRange":">= 8.11.0 < 8.11.2"},{"id":"GHSA-8m4g-j4wp-wgcg","title":"Authlib accepts an empty HMAC key, allowing JWS\/JWT signature forgery (HS256\/HS384\/HS512)","aliases":["CVE-2026-114616"],"summary":"Reporter: Cavan Loughran, Celvex Group Inc.\n\nSummary\n\nAuthlib's symmetric (oct) key handling accepts an empty key (empty bytes b'' \/ empty string '') as a valid HMAC signing and verification key. An empty HMAC key produces a deterministic digest that any party can reproduce, so a","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Authlib","publishedAt":"2026-10-27T16:09:22Z","exploitedKev":false,"fixedVersion":"1.9.1","vulnerableRange":"< 1.9.1"},{"id":"GHSA-7vr2-2fgp-9w7p","title":"Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys","aliases":["CVE-2026-114615"],"summary":"## Summary\n\n`OctKey.import_key()` carries the only guard that stops an asymmetric public key from being used as an\nHMAC secret in `authlib.jose`. That guard is `raw_key.startswith(POSSIBLE_UNSAFE_KEYS)` \u2014 anchored at\nbyte 0 \u2014 while the loader that consumes the identical bytes on ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"authlib","publishedAt":"2026-10-27T15:38:48Z","exploitedKev":false,"fixedVersion":"1.9.0","vulnerableRange":">= 1.3.1 <= 1.8.0"},{"id":"GHSA-j2w7-387v-m2rq","title":"PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated \u2192 CPU & Memory Exhaustion (DoS)","aliases":["CVE-2026-108359"],"summary":"## Summary\n\nWhen PhpSpreadsheet loads an OpenDocument Spreadsheet (`.ods`), `Ods::processTableRow()`\nreads the `table:number-rows-repeated` attribute of a `<table:table-row>` with an unchecked \n`(int)` cast, then materialises one cell per repeated row. This value is **completely ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"phpoffice\/phpspreadsheet","publishedAt":"2026-10-27T15:38:33Z","exploitedKev":false,"fixedVersion":"5.10.0","vulnerableRange":">= 4.0.0 <= 5.9.0"},{"id":"GHSA-3x94-m842-937c","title":"PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service","aliases":["CVE-2026-108358"],"summary":"### Summary\nPhpSpreadsheet's `XmlScanner::scan()` uses a regex pattern that only accounts for NULL byte (0x00) interleaving when detecting `<!DOCTYPE`. ISO-2022 escape sequences (0x1B bytes) inserted between the characters of the pattern break the regex match entirely, allowing D","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"phpoffice\/phpspreadsheet","publishedAt":"2026-10-27T15:38:28Z","exploitedKev":false,"fixedVersion":"5.10.0","vulnerableRange":">= 4.0.0 <= 5.9.0"},{"id":"GHSA-rxj4-h86g-25gc","title":"PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service","aliases":["CVE-2026-108357"],"summary":"### Summary\nThe SpreadsheetML XML reader (`Reader\\Xml`) scans file content **twice** through `XmlScanner::scan()`, and each scan runs an `unentity()` callback that calls `html_entity_decode()` **after** the pattern check. By double-encoding the `<` character as `&#38;#60;`, the f","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"phpoffice\/phpspreadsheet","publishedAt":"2026-10-27T15:38:22Z","exploitedKev":false,"fixedVersion":"5.10.0","vulnerableRange":">= 4.0.0 <= 5.9.0"},{"id":"GHSA-fpmh-frq8-7rj8","title":"compress zstd: Panic on two-block frames","aliases":["CVE-2026-116591"],"summary":"### Summary\n\nA crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be c","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/klauspost\/compress\/zstd","publishedAt":"2026-10-27T15:38:14Z","exploitedKev":false,"fixedVersion":"1.20.2","vulnerableRange":"<= 1.20.1"},{"id":"GHSA-45c3-73f7-pv4m","title":"dnspython dns.name.from_wire_parser() excessive CPU use","aliases":["CVE-2026-114605"],"summary":"### Impact\nA maliciously crafted DNS message may cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression.  Applications that process untrusted DNS wire form messages with dnspython may be degraded or DoS'd by the extra CPU use required.\n\n### Patches\nThis","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"dnspython","publishedAt":"2026-10-27T15:37:37Z","exploitedKev":false,"fixedVersion":"2.9.0","vulnerableRange":"< 2.9.0"},{"id":"GHSA-3633-r77q-h3v3","title":"Datadog dd-trace-py: ReDoS in URL query string obfuscation","aliases":["CVE-2026-116588"],"summary":"### Summary\n\nA regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations.\n\n### Details\n","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"ddtrace","publishedAt":"2026-10-27T15:37:31Z","exploitedKev":false,"fixedVersion":"3.19.9","vulnerableRange":">= 1.5.0 < 3.19.9"},{"id":"GHSA-p3m5-h5v9-vqj6","title":"Datadog dd-trace-py: IAST instrumentation can lead to application DOS","aliases":["CVE-2026-116589"],"summary":"### Summary\n\nA flaw in dd-trace-py\u2019s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default.\n\n### Details\n\nThe affecte","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"ddtrace","publishedAt":"2026-10-27T15:37:24Z","exploitedKev":false,"fixedVersion":"4.15.5","vulnerableRange":">= 3.13.0 < 4.15.5"},{"id":"GHSA-98qm-wvgf-w4cf","title":"MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element","aliases":["CVE-2026-106435"],"summary":"### Impact\nThe C extension's BSON decoder scans a Regex element's pattern and flags strings with strlen before checking the document's remaining length, so a crafted truncated Regex element can read past the end of the caller's buffer. bson.decode and bson.decode_all accept mmap ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pymongo","publishedAt":"2026-10-27T15:36:35Z","exploitedKev":false,"fixedVersion":"4.18.3","vulnerableRange":">= 3.9.0 <= 4.18.2"},{"id":"GHSA-h3rc-6mm3-gc2m","title":"vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution","aliases":["CVE-2026-114053"],"summary":"## Summary\n\nAn untrusted multimodal request can set `mm_processor_kwargs.code_revision`. When vLLM serves a model whose Hugging Face processor uses dynamic `auto_map` code and the operator enabled `--trust-remote-code`, this request value reaches `AutoProcessor.from_pretrained` a","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"vllm","publishedAt":"2026-10-27T15:36:17Z","exploitedKev":false,"fixedVersion":"0.31.0","vulnerableRange":">= 0.7.3 < 0.31.0"},{"id":"GHSA-3w55-933p-8pv5","title":"Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage","aliases":[],"summary":"## Summary\n\nThe `FileSessionManager` defaults to storing session data in `\/tmp\/strands\/sessions\/` (a world-writable directory) using predictable file paths and a write pattern (`open(path + \".tmp\", \"w\")` \u2192 `os.replace()`) that follows symbolic links. A local attacker can exploit ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"strands-agents","publishedAt":"2026-10-27T15:34:33Z","exploitedKev":false,"fixedVersion":"1.48.0","vulnerableRange":"< 1.48.0"},{"id":"GHSA-vqrg-773h-4wxc","title":"Flexible GraphRAG: Cypher\/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content","aliases":["CVE-2026-114510"],"summary":"**Description**\ndef _escape(v: str) -> str:\n    return str(v).replace(\"'\", \"\\\\'\").replace(\"\\\\\", \"\\\\\\\\\")\nThe escaping order is backwards, exactly like the classic HTML double-escape bug: step 1 inserts a literal backslash in front of every ', then step 2 re-matches that just-inser","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"flexible-graphrag","publishedAt":"2026-10-27T15:32:45Z","exploitedKev":false,"fixedVersion":"0.8.2","vulnerableRange":">= 0.6.0 < 0.8.2"},{"id":"GHSA-g5ff-637f-6q2m","title":"LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`","aliases":[],"summary":"## Summary\n\nAn authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted `vertex_ai_credentials` value to `\/utils\/transform_request`. The request-body safety blocklist rejected `vertex_credentials` but missed its alias `vertex_a","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"litellm","publishedAt":"2026-10-27T15:32:36Z","exploitedKev":false,"fixedVersion":"1.95.0","vulnerableRange":"< 1.95.0"},{"id":"GHSA-r4xp-prcw-77qf","title":"better-auth: OAuth Proxy lets an attacker sign in as another user","aliases":[],"summary":"## Am I affected?\n\nYou may be affected if you use `better-auth` from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if **all** of these are also true:\n\n- On a participating environment, the OAuth Proxy plugin has no dedicated `secre","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"better-auth","publishedAt":"2026-10-27T15:32:16Z","exploitedKev":false,"fixedVersion":"1.7.7","vulnerableRange":">= 1.5.0-beta.12 < 1.7.7"},{"id":"GHSA-965c-763c-88jm","title":"better-auth: OAuth state can be used as a Magic Link to sign in as another user","aliases":["CVE-2026-114607"],"summary":"## Am I affected?\n\nYou may be affected if you use `better-auth` from `1.4.0-beta.18` through versions before `1.7.7` with the Magic Link plugin and social or Generic OAuth sign-in.\n\nYou are affected if **all** of these are true:\n\n- Magic Link is enabled with default `storeToken: ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"better-auth","publishedAt":"2026-10-27T15:32:05Z","exploitedKev":false,"fixedVersion":"1.7.7","vulnerableRange":">= 1.4.0-beta.18 < 1.7.7"},{"id":"GHSA-23mf-xhv8-69c2","title":"GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)","aliases":[],"summary":"> **A note on the referenced files.** This report was submitted through GitHub's private\n> vulnerability reporting API, which carries no attachments. Every transcript this report leans\n> on is reproduced **inline above**, verbatim. The file names it mentions (`poc.sh`, `poc.log`,","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-10-27T15:28:03Z","exploitedKev":false,"fixedVersion":"3.2.0","vulnerableRange":"<= 3.1.62"},{"id":"GHSA-f9j4-qggq-h239","title":"GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution","aliases":[],"summary":"## Summary\n\n`Remote.pull()` in GitPython forwards its positional `refspec` argument directly to the `git pull` child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the `refspec` (for example a user-sup","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-10-27T15:26:50Z","exploitedKev":false,"fixedVersion":"3.2.0","vulnerableRange":">= 3.1.30 < 3.2.0"},{"id":"GHSA-w8jc-g24h-crhw","title":"GitPython command wrappers omit unsafe protocol and option checks","aliases":[],"summary":"### Summary\n\nGitPython has spent 2022-2026 rolling out two reusable guards method-by-method: `Git.check_unsafe_protocols(url)` (raises `UnsafeProtocolError` for `<transport>::` remote-helper URLs - CVE-2022-24439) and `Git.check_unsafe_options(...)` (raises `UnsafeOptionError` fo","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-10-27T15:26:43Z","exploitedKev":false,"fixedVersion":"3.2.0","vulnerableRange":"<= 3.1.62"},{"id":"GHSA-m64x-33q8-m5h7","title":"GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines","aliases":[],"summary":"### Summary\n\nThis is a residual of GHSA-g5vv-9gxw-82hx \/ CVE-2026-87819. The 3.1.60 fix made `Actor._from_string` regex-free, but `parse_actor_and_date` still runs `_re_actor_epoch` on the same author\/committer\/tagger line one step earlier. That pattern backtracks quadratically w","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-10-27T15:26:24Z","exploitedKev":false,"fixedVersion":"3.2.0","vulnerableRange":"<= 3.1.62"},{"id":"GHSA-7hp6-4w63-5g45","title":"LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key","aliases":["CVE-2026-114612"],"summary":"### Summary\n\nAn authenticated user with `internal_user` privileges can escalate to `proxy_admin` and achieve remote code execution. The proxy uses one encryption key for two purposes: sealing secrets at rest and minting session tokens. An attacker exploits this by requesting a ne","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"litellm","publishedAt":"2026-10-27T15:04:14Z","exploitedKev":false,"fixedVersion":"1.100.4","vulnerableRange":">= 1.91.0 < 1.100.4"},{"id":"GHSA-j586-36cw-2gc2","title":"MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure","aliases":["CVE-2026-114613"],"summary":"### Impact\n\nThe msgpack-python C extension (`msgpack._cmsgpack`) leaks a decoded map value when deserialization rejects a key with `strict_map_key=True` (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that d","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"msgpack","publishedAt":"2026-10-27T15:04:07Z","exploitedKev":false,"fixedVersion":"1.2.3","vulnerableRange":"< 1.2.3"},{"id":"GHSA-j456-xh4h-cpf2","title":"NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment","aliases":[],"summary":"## Summary\n`WekaClassifier` in NLTK passes a caller-controlled model file path to the weka Java VM without any `nltk.pathsec` validation. `WekaClassifier.train` puts the caller's `model_filename` verbatim into the weka argv `[\"-d\", model_filename, ...]` (weka *writes* the trained","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-10-27T14:50:30Z","exploitedKev":false,"fixedVersion":"3.10.4","vulnerableRange":"<= 3.10.3"},{"id":"GHSA-6v38-4h7w-rj9h","title":"Authlib: empty signatures validation in JWS JSON deserialization","aliases":["CVE-2026-96760"],"summary":"Authlib (prior to 1.9.0) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a crypto","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"authlib","publishedAt":"2026-10-27T14:50:18Z","exploitedKev":false,"fixedVersion":"1.9.0","vulnerableRange":"<= 1.8.0"},{"id":"GHSA-q84f-53jg-9ppm","title":"better-auth: Device login approval does not show the requesting client or permissions","aliases":[],"summary":"## Am I affected?\n\nYou may be affected if you use `better-auth` from `1.3.8-beta.3` up to, but not including, `1.7.0-rc.3`, and you enable the `deviceAuthorization()` plugin. This range includes all 1.6 releases.\n\nYou are affected only if all of these are also true:\n\n- An attacke","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"better-auth","publishedAt":"2026-10-27T14:49:53Z","exploitedKev":false,"fixedVersion":"1.7.0-rc.3","vulnerableRange":">= 1.3.8-beta.3 < 1.7.0-rc.3"},{"id":"GHSA-qr6x-7v33-6qmg","title":"Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs","aliases":["CVE-2026-115924"],"summary":"The public `\/api\/remove` endpoint uses attacker-controlled `extras.sam_model` in both SAM filenames and GitHub download URLs. Path traversal plus a URL fragment lets an unauthenticated attacker place malicious ONNX models beside a target file. The models read the file as ONNX ext","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"rembg","publishedAt":"2026-10-27T14:45:36Z","exploitedKev":false,"fixedVersion":"2.0.82","vulnerableRange":"< 2.0.82"},{"id":"GHSA-m4w4-3r8h-jw98","title":"Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`","aliases":["CVE-2026-35002"],"summary":"### Impact\nAgno versions prior to 2.3.24 contain an arbitrary code execution vulnerability\nin the model execution component. The `field_type` parameter on a `FunctionCall`\ninput field was passed to Python's built-in `eval()`, allowing an attacker who\ncould influence that value to","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"agno","publishedAt":"2026-10-27T13:30:41Z","exploitedKev":false,"fixedVersion":"2.3.24","vulnerableRange":"< 2.3.24"},{"id":"GHSA-3jp2-3mrg-2vxc","title":"OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow","aliases":["CVE-2026-49272"],"summary":"### Summary\nA call to the token endpoint with a grant type of `\"urn:ietf:params:oauth:grant-type:device_code\"` and a bogus `device_code` is able to get a bearer token as long as they know a valid client ID enabled for the device workflow.\n\n### Details\n\n[Section 3.4 of the RFC 862","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"oauthlib","publishedAt":"2026-10-27T13:30:17Z","exploitedKev":false,"fixedVersion":"4.0.0","vulnerableRange":">= 3.3.0 < 4.0.0"},{"id":"GHSA-6hp3-vr39-rqw8","title":"MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS\/IS Validation Bypass)","aliases":["CVE-2026-48705"],"summary":"### Summary\n\nAn unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal St","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"monai","publishedAt":"2026-10-27T13:30:10Z","exploitedKev":false,"fixedVersion":"1.6.1","vulnerableRange":"< 1.6.1"},{"id":"GHSA-47hv-j4px-h3c9","title":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins","aliases":["CVE-2026-34157"],"summary":"# Security Vulnerability Report: Wails v2 \u2014 Origin Validator Bypass via Wildcard Pattern\n\n| | |\n|---|---|\n| **Product** | wailsapp\/wails (v2) |\n| **Affected File** | `v2\/internal\/frontend\/originvalidator\/originValidator.go` |\n| **Affected Versions** | All versions containing orig","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/wailsapp\/wails\/v2","publishedAt":"2026-10-27T13:29:47Z","exploitedKev":false,"fixedVersion":"2.13.0","vulnerableRange":">= 2.0.0 < 2.13.0"},{"id":"GHSA-v5fq-cf5m-vwv7","title":"Dolibarr has SQL Injection in societe\/class\/societe.class.php via localtax1_value parameter","aliases":["CVE-2026-33944"],"summary":"### Summary\n\n  A SQL Injection vulnerability exists in the Third Party (Company) update functionality of Dolibarr ERP\/CRM. The `localtax1_value` parameter (`lt1`) is concatenated\n  directly into an SQL UPDATE statement in `societe\/class\/societe.class.php` at line 1672 without any","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"dolibarr\/dolibarr","publishedAt":"2026-10-27T13:29:25Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 23.0.0"},{"id":"GHSA-vcw3-r3fx-j444","title":"Ajenti has potential Remote Code Execution","aliases":["CVE-2026-27975"],"summary":"### Impact\n\nAn unauthenticated user could gain access to a server to execute arbitrary code on this server.\n\n### Patches\n\nThis is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible.","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"aj","publishedAt":"2026-10-27T13:27:58Z","exploitedKev":false,"fixedVersion":"2.2.13","vulnerableRange":"< 2.2.13"},{"id":"GHSA-394h-qwmc-48pf","title":"virtualenv: Xonsh activation literals depend on the script decoding codec","aliases":["CVE-2026-113718"],"summary":"## Summary\n\nCaller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the\nvalue passed to virtualenv, and a user must subsequently activate the environment.\n\n## Affected area\n\nXonsh reads a UTF-8 activation script using a ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"virtualenv","publishedAt":"2026-10-23T22:24:43Z","exploitedKev":false,"fixedVersion":"21.14.9","vulnerableRange":"< 21.14.9"},{"id":"GHSA-6w3r-xr62-4xcp","title":"virtualenv: Bash prompt values can change meaning under older compatibility modes","aliases":["CVE-2026-113723"],"summary":"## Summary\n\nCaller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the\nvalue passed to virtualenv, and a user must subsequently activate the environment and draw the prompt.\n\n## Affected area\n\nBash runs with compatibilit","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"virtualenv","publishedAt":"2026-10-23T22:21:57Z","exploitedKev":false,"fixedVersion":"21.14.9","vulnerableRange":"< 21.14.9"},{"id":"GHSA-xcx6-jx8p-x3h5","title":"MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint","aliases":["CVE-2026-109461"],"summary":"### Impact\n\nOrigin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.\n\n### Patches\n\nVersion 7.1.0 and higher are patched.\n\n### Workarounds\n\nEnsure you pas","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@azure\/msal-node","publishedAt":"2026-10-23T22:16:44Z","exploitedKev":false,"fixedVersion":"7.1.0","vulnerableRange":">= 5.0.0-beta.0 < 7.1.0"},{"id":"GHSA-xjj6-f33q-929c","title":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings","aliases":["CVE-2026-109869"],"summary":"### Impact\n\nundici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal respo","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"undici","publishedAt":"2026-10-23T22:14:31Z","exploitedKev":false,"fixedVersion":"6.29.1","vulnerableRange":">= 6.23.0 < 6.29.1"},{"id":"GHSA-q7qp-rjg7-q26m","title":"multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown","aliases":["CVE-2026-113872"],"summary":"### Impact\n\nWhen `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async `fileFilter` is still pending, the pending callback later resumes ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"multer","publishedAt":"2026-10-23T22:08:22Z","exploitedKev":false,"fixedVersion":"2.5.0","vulnerableRange":">= 2.0.0 < 2.5.0"},{"id":"GHSA-834v-8h66-3h79","title":"Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution","aliases":["CVE-2026-115895"],"summary":"## Summary\n\nThe ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolating them into generated JavaScript.\n\nAs a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and exe","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"happy-dom","publishedAt":"2026-10-23T22:06:13Z","exploitedKev":false,"fixedVersion":"21.0.4","vulnerableRange":">= 17.0.0 <= 21.0.3"},{"id":"GHSA-897f-g5gm-fmxm","title":"Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation","aliases":["CVE-2026-115889"],"summary":"## Summary\n\nIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function","severity":"critical","sourceId":"github-advisories","ecosystem":"cargo","packageName":"wasmtime","publishedAt":"2026-10-23T22:02:20Z","exploitedKev":false,"fixedVersion":"36.0.19","vulnerableRange":"< 36.0.19"},{"id":"GHSA-v4x8-3wr5-3wq8","title":"filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files","aliases":["CVE-2026-112940"],"summary":"`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader\/writer lock) hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor (the number the kernel gives a process for an open file). It then connects SQLite to `\/proc\/self\/f","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"filelock","publishedAt":"2026-10-23T21:59:08Z","exploitedKev":false,"fixedVersion":"4.2.1","vulnerableRange":">= 3.20.4 <= 4.2.0"},{"id":"GHSA-5x8w-8jj5-q52h","title":"Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution","aliases":["CVE-2026-112398"],"summary":"### Credits\n\n**Researcher**: Alex Bouffard (mixbo@pebwalker.com)\n\n### Summary\n\nA heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with `Image.open()`. The fi","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pillow","publishedAt":"2026-10-23T21:55:21Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":"<= 12.3.0"},{"id":"GHSA-f2hq-32vh-53cc","title":"postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words","aliases":[],"summary":"### Impact\n\nDecoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"postal-mime","publishedAt":"2026-10-23T21:54:36Z","exploitedKev":false,"fixedVersion":"4.0.8","vulnerableRange":">= 3.0.0 < 4.0.8"},{"id":"GHSA-f9x3-7vq9-cph6","title":"Laravel TokenGuard authentication bypass through non-string API credentials","aliases":["CVE-2026-114509"],"summary":"Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. \n\n**Under certain database configurations (MySQL\/MariaDB)** an attacker can submit a","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"laravel\/framework","publishedAt":"2026-10-23T21:50:27Z","exploitedKev":false,"fixedVersion":"13.29.0","vulnerableRange":">= 13.0.0 < 13.29.0"},{"id":"GHSA-gx7p-2j49-hfq4","title":"vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)","aliases":["CVE-2026-114055"],"summary":"## Summary\n\nAPI clients can supply arbitrary `mm_processor_kwargs` per request. vLLM\nforwards these values through the multimodal rendering and processing pipeline\nto Hugging Face and custom image\/video processor constructors and calls.\nResource-sensitive values such as image siz","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"vllm","publishedAt":"2026-10-23T20:58:36Z","exploitedKev":false,"fixedVersion":"0.31.0","vulnerableRange":">= 0.7.3 < 0.31.0"},{"id":"GHSA-6c7f-9265-g8fw","title":"pypdf: Possible long runtimes for repeated references to the same missing object","aliases":["CVE-2026-115572"],"summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.\n\n### Patches\n\nThis has been fixed in ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pypdf","publishedAt":"2026-10-23T20:55:15Z","exploitedKev":false,"fixedVersion":"6.21.2","vulnerableRange":"< 6.21.2"},{"id":"GHSA-jr96-gvgh-j3r4","title":"pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)","aliases":["CVE-2026-115585"],"summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.2](https:\/\/github.com\/py-pdf\/pypdf\/releases\/t","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pypdf","publishedAt":"2026-10-23T20:54:27Z","exploitedKev":false,"fixedVersion":"6.21.2","vulnerableRange":"< 6.21.2"},{"id":"GHSA-gmh7-3g9r-mjh5","title":"pypdf: Possible long runtimes for large xref table header limits","aliases":["CVE-2026-115580"],"summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large\/wrong upper limits in the xref table.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.2](https:\/\/github.com\/py-pdf\/pypdf\/releases\/tag\/6.21.2","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pypdf","publishedAt":"2026-10-23T20:54:12Z","exploitedKev":false,"fixedVersion":"6.21.2","vulnerableRange":"< 6.21.2"},{"id":"GHSA-jr5w-w6x2-84p9","title":"Electron: Mitigation for compromised eMudhra intermediate certificates","aliases":["CVE-2026-115570"],"summary":"### Impact\n\nA set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"electron","publishedAt":"2026-10-23T20:53:41Z","exploitedKev":false,"fixedVersion":"45.0.0-beta.6","vulnerableRange":">= 45.0.0-alpha.1 < 45.0.0-beta.6"},{"id":"GHSA-27r3-jxmh-p828","title":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","aliases":["CVE-2026-111181"],"summary":"### Impact\n\nA single request can crash any application using `body-parser` with default options. When a request carries a `Content-Encoding` (for example `gzip`), `body-parser` pipes it into a decompression stream and, after reading the body, leaves that stream piped with no erro","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"body-parser","publishedAt":"2026-10-23T20:53:11Z","exploitedKev":false,"fixedVersion":"2.4.0","vulnerableRange":">= 2.0.0 < 2.4.0"},{"id":"GHSA-q54r-jf2p-rfr2","title":"gitoxide gix: untrusted .git\/config disables filesystem .git-protection path checks via unfiltered protect_options()","aliases":[],"summary":"## Summary\n\nIn the `gix` crate, `Cache::protect_options()` in `gix\/src\/config\/cache\/access.rs` reads the three filesystem path-protection settings (`core.protectHFS`, `core.protectNTFS`, and `gitoxide.core.protectWindows`) with the unfiltered `gix_config::File::boolean()` accesso","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"gix","publishedAt":"2026-10-23T20:52:28Z","exploitedKev":false,"fixedVersion":"0.90.0","vulnerableRange":">= 0.88.0 <= 0.89.0"},{"id":"GHSA-9969-6676-49h5","title":"Echo: WebSocket proxy can retain connections and handlers after client disconnect","aliases":[],"summary":"## Impact\n\nEcho's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/labstack\/echo\/v4","publishedAt":"2026-10-23T20:50:17Z","exploitedKev":false,"fixedVersion":"4.16.1","vulnerableRange":">= 4.15.0 < 4.16.1"},{"id":"GHSA-h7wr-284f-5qvc","title":"Echo: Decompress permits unbounded gzip expansion in v4","aliases":[],"summary":"## Impact\n\nEcho v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, an","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/labstack\/echo\/v4","publishedAt":"2026-10-23T20:49:49Z","exploitedKev":false,"fixedVersion":"4.16.1","vulnerableRange":">= 4.0.0 < 4.16.1"},{"id":"GHSA-cxf3-9h37-7rr8","title":"Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls","aliases":[],"summary":"## Impact\n\nEcho's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on tha","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/labstack\/echo\/v4","publishedAt":"2026-10-23T20:49:37Z","exploitedKev":false,"fixedVersion":"4.16.1","vulnerableRange":">= 4.0.0 < 4.16.1"},{"id":"GHSA-f48p-c9v4-h7xv","title":"Echo: BodyDump captures request and response bodies without size limits in v4","aliases":[],"summary":"## Impact\n\nEcho v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ra","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/labstack\/echo\/v4","publishedAt":"2026-10-23T20:48:44Z","exploitedKev":false,"fixedVersion":"4.16.1","vulnerableRange":">= 4.0.0 < 4.16.1"},{"id":"GHSA-4v6f-7vjh-6x4m","title":"Strands Agents SDK: Exposure of data element to wrong session in the A2A Server","aliases":["CVE-2026-115419"],"summary":"**Summary**  \nStrands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-agents\/sdk), for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent (A2A) server shares conversation history acr","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"strands-agents","publishedAt":"2026-10-23T20:48:29Z","exploitedKev":false,"fixedVersion":"1.43.0","vulnerableRange":"< 1.43.0"},{"id":"GHSA-cx6f-vjhg-g3cc","title":"virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)","aliases":["CVE-2026-115586"],"summary":"## Summary\n\nThe bash activator puts the caller-supplied prompt value into `PS1` unescaped whenever `promptvars` is off at activation time, and assumes prompt expansion can never run afterwards. `promptvars` and posix mode are runtime shell state, not a property of the activation ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"virtualenv","publishedAt":"2026-10-23T20:47:16Z","exploitedKev":false,"fixedVersion":"21.14.13","vulnerableRange":">= 21.14.9 < 21.14.13"},{"id":"GHSA-h7ww-273w-6cm8","title":"Mistune: Path Traversal and XSS in Include directive","aliases":["CVE-2026-115355"],"summary":"The Include directive in `src\/mistune\/directives\/include.py` does not validate that the resolved file path stays within the source directory, allowing path traversal via `..\/` sequences to read arbitrary files.\n\nAdditionally, error messages and included file contents are rendered","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mistune","publishedAt":"2026-10-23T20:46:47Z","exploitedKev":false,"fixedVersion":"3.3.0","vulnerableRange":"<= 3.2.0"},{"id":"GHSA-53xc-49m8-p798","title":"Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer","aliases":["CVE-2026-115776"],"summary":"## Summary\n\nAn unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. `twisted.words.protocols.irc.IRC.dataReceived` appends every received byte to a per-connection buffer and only removes data at a l","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Twisted","publishedAt":"2026-10-23T20:45:35Z","exploitedKev":false,"fixedVersion":"26.10.0rc1","vulnerableRange":"<= 26.4.0"},{"id":"GHSA-cwm5-jh59-mwxr","title":"Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer","aliases":["CVE-2026-115778"],"summary":"## Summary\n\nAn allocation-without-limits vulnerability (CWE-770) in the Twisted conch telnet transport lets any unauthenticated remote peer exhaust server memory over a single connection. When the peer opens a telnet subnegotiation with `IAC SB` and then streams bytes without eve","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Twisted","publishedAt":"2026-10-23T20:45:26Z","exploitedKev":false,"fixedVersion":"26.10.0rc1","vulnerableRange":"<= 26.4.0"},{"id":"GHSA-3476-c5c2-fr73","title":"Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree","aliases":["CVE-2026-115775"],"summary":"## Summary\n\nAn allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every e","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Twisted","publishedAt":"2026-10-23T20:45:04Z","exploitedKev":false,"fixedVersion":"26.10.0rc1","vulnerableRange":"<= 26.4.0"},{"id":"GHSA-r3g7-r4hr-m258","title":"obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes","aliases":["CVE-2026-115478"],"summary":"### Summary\n`create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate a memory note's body from SQLite at the computed `memory\/<type>\/<name>.md` path. When a note already existed at that path and was not owned by the entity being written ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"obsidian-tc","publishedAt":"2026-10-23T18:47:25Z","exploitedKev":false,"fixedVersion":"1.31.4","vulnerableRange":">= 1.0.1 <= 1.31.3"},{"id":"GHSA-c8w8-3pqp-wr83","title":"SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream","aliases":["CVE-2026-73054"],"summary":"### Summary\n\nTwo checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's `url.Values.Get` retu","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-10-23T18:34:09Z","exploitedKev":false,"fixedVersion":"0.0.0-20260731131820-67bc300b6ea6","vulnerableRange":"< 0.0.0-20260731131820-67bc300b6ea6"},{"id":"GHSA-pqh8-4pj7-32xx","title":"obsidian-tc HTTP transport lacks Origin\/DNS-rebinding protection, enabling drive-by vault access on loopback","aliases":["CVE-2026-77363"],"summary":"### Impact\nThe Streamable HTTP transport was constructed without `enableDnsRebindingProtection`\/`allowedHosts`\/`allowedOrigins` and performed no `Origin`-header validation. With the documented `auth.mode: \"none\"` loopback default, a **drive-by web page could `POST http:\/\/127.0.0.","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"obsidian-tc","publishedAt":"2026-10-23T18:29:02Z","exploitedKev":false,"fixedVersion":"1.3.1","vulnerableRange":"< 1.3.1"},{"id":"GHSA-737x-cwfr-5vvc","title":"obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP","aliases":["CVE-2026-115477"],"summary":"### Summary\nOn a Streamable HTTP deployment with `auth.jwtSecret` configured, serving a 2026-07-28-era client that declared `elicitation.form` support, a call to a dispatch-gated tool (`destructive: true`, or a scope with an HITL floor) that was offered an `inputRequired` confirm","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"obsidian-tc","publishedAt":"2026-10-23T17:30:10Z","exploitedKev":false,"fixedVersion":"1.31.4","vulnerableRange":">= 1.13.0 <= 1.31.3"},{"id":"GHSA-84c9-qqpq-2pq5","title":"obsidian-tc tokens can access arbitrary configured vaults","aliases":["CVE-2026-77366"],"summary":"### Impact\nTool dispatch did not check the caller-supplied `input.vault` against the caller's bound vault (`ctx.vaultId`); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, **any valid token could read, write, or delete any configured va","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"obsidian-tc","publishedAt":"2026-10-23T17:29:17Z","exploitedKev":false,"fixedVersion":"1.3.1","vulnerableRange":"< 1.3.1"},{"id":"GHSA-8cqv-vvq2-6p8c","title":"Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references.\n\n## Original Description\nMistune before 3.3.0 contains a path traversal vulnerability in the Include directive that a","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mistune","publishedAt":"2026-10-22T21:32:36Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 3.3.0"},{"id":"GHSA-78g4-xqwv-q3g8","title":"Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()","aliases":[],"summary":"### Summary\n\nEvery Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow **write** that is fixed upstream on master but has never appeared in an OpenJPEG release. See https:\/\/osv.dev\/vulnerability\/OSV-2025-219\n\nBecause the wheel bundles its own co","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pillow","publishedAt":"2026-10-22T17:01:08Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 11.1.0 < 13.0.0"},{"id":"GHSA-673q-mjm6-r5xr","title":"Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays","aliases":[],"summary":"## Impact\n\nA vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.\n\n## Workaround\n\nThere is no known workaround for affected applications with","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"next","publishedAt":"2026-10-22T16:42:31Z","exploitedKev":false,"fixedVersion":"16.4.1","vulnerableRange":">= 16.0.0 <= 16.4.0"},{"id":"GHSA-83vg-56qc-22m7","title":"GitPython validates a submodule's \".git\" path only after cloning into it (RCE)","aliases":["CVE-2026-114145"],"summary":"### Summary\n\n\n`create_submodule(name, path, url)` clones a submodule into the repo's own `.git`\ndirectory before it rejects the path. A `path` of \".git\/hooks\" is accepted by the\npre-clone check, so the submodule is cloned straight into the live hooks directory,\nand a file named `","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Gitpython","publishedAt":"2026-10-22T16:41:14Z","exploitedKev":false,"fixedVersion":"3.2.1","vulnerableRange":"<= 3.2.0"},{"id":"GHSA-h895-cgqg-jf52","title":"toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype","aliases":["CVE-2026-114142"],"summary":"### Summary\nCVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead o","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"tome","publishedAt":"2026-10-22T16:39:55Z","exploitedKev":false,"fixedVersion":"5.0.1","vulnerableRange":"<= 5.0.0"},{"id":"GHSA-4qx8-w7c3-pj3p","title":"toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()","aliases":["CVE-2026-114141"],"summary":"## Summary\n\n`toml.parse()` is vulnerable to a quadratic-complexity (O(n\u00b2)) denial-of-service via many\narray-of-tables (`[[name]]`) headers. `addTableArray()` in `lib\/compiler.js` rescans two\nentire bookkeeping Sets on every `[[name]]` header without pruning unrelated or distinct\n","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"toml","publishedAt":"2026-10-22T16:38:44Z","exploitedKev":false,"fixedVersion":"5.0.1","vulnerableRange":"<= 5.0.0"},{"id":"GHSA-9j65-hcg3-gc64","title":"toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()","aliases":["CVE-2026-114143"],"summary":"## Summary\n\n`toml.parse()` is vulnerable to a quadratic-complexity (O(n\u00b2)) denial-of-service via a single\nlong dotted key, table header, or inline-table key. A ~100KB crafted document causes a\nmulti-second synchronous hang; a ~200KB document crashes the Node.js process outright w","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"toml","publishedAt":"2026-10-22T16:38:06Z","exploitedKev":false,"fixedVersion":"5.0.1","vulnerableRange":"<= 5.0.0"},{"id":"GHSA-9qmh-m7c6-f92p","title":"toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()","aliases":["CVE-2026-114144"],"summary":"### Summary\n`toml.parse()` converts integer literals (hex, octal, binary, and decimal) to `BigInt` without first bounding the length of the digit sequence. Since `BigInt(string)` construction from a very long numeric string runs in super-linear time, a single small, well-formed T","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"toml","publishedAt":"2026-10-22T16:36:50Z","exploitedKev":false,"fixedVersion":"5.0.1","vulnerableRange":"<= 5.0.0"},{"id":"GHSA-px85-f4q5-jh77","title":"Storybook dev server vulnerable to code injection from the local network","aliases":["CVE-2026-114126"],"summary":"**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to c","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"storybook","publishedAt":"2026-10-22T16:31:40Z","exploitedKev":false,"fixedVersion":"8.6.19","vulnerableRange":">= 8.0.0 < 8.6.19"},{"id":"GHSA-c4qx-w738-7hr3","title":"GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments","aliases":["CVE-2026-114604"],"summary":"## Report metadata\n\n| Field | Value |\n| --- | --- |\n| Package | `@graphql-tools\/utils` (npm, `pkg:github\/ardatan\/graphql-tools`) |\n| Repository | https:\/\/github.com\/ardatan\/graphql-tools |\n| Component | `mergeIncrementalResult` \/ `setObjectKeyPath` (`packages\/utils\/src\/mergeIncre","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@graphql-tools\/utils","publishedAt":"2026-10-22T16:28:31Z","exploitedKev":false,"fixedVersion":"12.0.2","vulnerableRange":">= 10.10.1 <= 12.0.1"},{"id":"GHSA-r77w-qph3-7vf8","title":"GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit","aliases":["CVE-2026-75508"],"summary":"### Summary\n\nThe parser's `max_tokens` limit \u2014 the documented defence against oversized GraphQL\ndocuments \u2014 did not count comment tokens. A document padded with comments could\ntherefore pass a `max_tokens` check of any size while still allocating one `Token`\nobject per comment, a","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"graphql-core","publishedAt":"2026-10-22T16:27:14Z","exploitedKev":false,"fixedVersion":"3.2.12","vulnerableRange":">= 3.2.3 < 3.2.12"},{"id":"GHSA-vj8h-fx38-h3vc","title":"GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule","aliases":["CVE-2026-75507"],"summary":"### Summary\n\nThe `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic \u2014 and\nin the worst case `O(n\u00b2\u00b7m\u00b2)` \u2014 running time by a small, highly compressible query. A\nsingle 364 KB document can occupy one CPU core for over five minutes during\n*validation*, before","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"graphql-core","publishedAt":"2026-10-22T16:26:40Z","exploitedKev":false,"fixedVersion":"3.2.12","vulnerableRange":">= 3.0.0 < 3.2.12"},{"id":"GHSA-cg2g-xh64-v4q7","title":"DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes","aliases":[],"summary":"## Summary\n\nWhen DOMPurify is configured with `SAFE_FOR_TEMPLATES: true` together with a DOM-returning mode (`RETURN_DOM: true`, `RETURN_DOM_FRAGMENT: true`, or `IN_PLACE: true`), template expressions such as `{{...}}`, `${...}`, and `<%...%>` survive sanitization inside the text","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"dompurify","publishedAt":"2026-10-22T16:25:31Z","exploitedKev":false,"fixedVersion":"3.4.17","vulnerableRange":">= 3.4.4 <= 3.4.16"},{"id":"GHSA-mrv2-3pqr-j5jr","title":"DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)","aliases":[],"summary":"### Summary\n\nThe 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an `IN_PLACE` hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"dompurify","publishedAt":"2026-10-22T16:24:52Z","exploitedKev":false,"fixedVersion":"3.4.17","vulnerableRange":"<= 3.4.16"},{"id":"GHSA-pjvx-prjx-h659","title":"nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc","aliases":["CVE-2026-114140"],"summary":"### Summary\n\nnbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.\n\nVulnerable converters : `--to markdown`, `--to latex`, `--to rst`, `--to asciidoc`.\n\nIn `ExtractOutputP","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nbconvert","publishedAt":"2026-10-22T16:23:28Z","exploitedKev":false,"fixedVersion":"7.17.2","vulnerableRange":">= 5.4.0 <= 7.17.1"},{"id":"GHSA-cg8m-r9f2-5wm2","title":"Black: GitHub Action installs unvalidated required-version from pyproject.toml","aliases":["CVE-2026-114134"],"summary":"### Summary\n\nThe GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.\n\n### Details\n\nTh","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"black","publishedAt":"2026-10-22T16:18:57Z","exploitedKev":false,"fixedVersion":"26.10.1","vulnerableRange":"< 26.10.1"},{"id":"GHSA-xw6w-gcfp-cf8m","title":"Django REST framework: TokenProxy.delete() reports success and revokes nothing","aliases":["CVE-2026-114137"],"summary":"### Summary\n\nDeleting an authentication token through `TokenProxy` silently deletes nothing. The call raises no\nexception and reports success, the database row survives, and the token keeps authenticating. Any\napplication, admin integration or operational script that revokes cred","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djangorestframework","publishedAt":"2026-10-22T16:18:05Z","exploitedKev":false,"fixedVersion":"3.18.2","vulnerableRange":">= 3.12.0 < 3.18.2"},{"id":"GHSA-33wh-fxxf-88vv","title":"Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation","aliases":["CVE-2026-114138"],"summary":"### Summary\n\nDRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parse_header_parameters, which takes quadratic time when a quoted parameter value is packed with sem","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djangorestframework","publishedAt":"2026-10-22T16:17:13Z","exploitedKev":false,"fixedVersion":"3.18.2","vulnerableRange":"< 3.18.2"},{"id":"GHSA-3547-9m27-7rxg","title":"Django REST framework: JSONParser applies an attacker-named codec to the request stream","aliases":["CVE-2026-114136"],"summary":"### Summary\n\nAn unauthenticated attacker can defeat Django's `DATA_UPLOAD_MAX_MEMORY_SIZE` limit and force a\nworker process to allocate arbitrary memory, by naming a compression codec in the Content-Type\ncharset parameter. A 108-byte request body produces a 50,331,648-character v","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djangorestframework","publishedAt":"2026-10-22T16:16:09Z","exploitedKev":false,"fixedVersion":"3.18.2","vulnerableRange":">= 3.6.4 < 3.18.2"},{"id":"GHSA-g7cr-3p24-7wf7","title":"Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer","aliases":["CVE-2026-96778"],"summary":"```\n============================================================================\nHeap buffer overflow writing JPEG comment after ICC profile fills buffer\nLocation: src\/libImaging\/JpegEncode.c:330  in ImagingJpegEncode()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n=========","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-22T16:05:39Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 9.4.0 < 13.0.0"},{"id":"GHSA-9v9v-9qvf-h2hj","title":"Pillow: Heap over-read in WMF\/EMF rendering via 16-bit dimension truncation (Windows builds)","aliases":["CVE-2026-96644"],"summary":"### Summary\nOn Windows builds, Pillow stores EMF and WMF image dimensions without a range check and passes them to the native `drawwmf` handler. That code sizes its allocation from dimensions truncated into 16-bit header fields but copies the result using the full 32-bit dimensio","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-22T16:03:14Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":"< 13.0.0"},{"id":"GHSA-g4qv-2jxx-769h","title":"Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time","aliases":["CVE-2026-96643"],"summary":"### Summary\n  A PNG file with a large eXIf chunk full of repeated 6-byte markers makes Pillow's EXIF parser take seconds of CPU instead of milliseconds. The cost grows with the square of the chunk size, so a normal small-photo-sized file is enough to cause real delay.\n\n  ### Deta","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-22T16:02:39Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 11.0.0 < 13.0.0"},{"id":"GHSA-3j72-p6qg-6xp7","title":"Pillow: TarIO negative size field causes infinite CPU-spin loop","aliases":["CVE-2026-96642"],"summary":"### Summary\n`TarIO.__init__` does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns.\n\n### Details\n`TarIO.__init__` reads 512-byte tar he","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-22T16:01:46Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":"< 13.0.0"},{"id":"GHSA-mrfp-p49p-3hf2","title":"Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion","aliases":["CVE-2026-96640"],"summary":"### Summary\nPillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree.\n\nAn attacker who can supply an existing PDF to an application that appends an image with `Image.save(..., format=\"PDF\", append=True)` can provide a malformed ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-22T16:00:47Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 5.1.0 < 13.0.0"},{"id":"GHSA-v9pv-5gc8-w2m6","title":"Pillow multi-frame loaders can reuse stale native image storage after mode transitions","aliases":["CVE-2026-96639"],"summary":"### Summary\nPillow multi-frame image loaders can retain native `ImagingCore` storage allocated for one frame while changing the Python-side image `mode` and decoder tiles for a later frame.\n\nIf frame 0 allocates storage for a narrow mode such as `L`, and a later frame of the same","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-22T16:00:15Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 11.0.0 < 13.0.0"},{"id":"GHSA-g842-9rc4-69pw","title":"Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS","aliases":["CVE-2026-96637"],"summary":"## Summary\nSpiderImagePlugin's seek() bypasses the decompression bomb check, allowing a tiny (<1KB) crafted SPIDER stack file to trigger a multi-gigabyte allocation on im.load().\n\n## Affected versions\nAll versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84)\n\n","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pillow","publishedAt":"2026-10-22T15:57:17Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":"< 13.0.0"},{"id":"GHSA-mchm-gjx6-7h55","title":"Sentry-Javascript: Middleware Bypass when using Tunnel route","aliases":["CVE-2026-114139"],"summary":"### Impact\n\nThe `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `\/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@sentry\/nextjs","publishedAt":"2026-10-22T15:55:07Z","exploitedKev":false,"fixedVersion":"9.47.2","vulnerableRange":">= 9.36.0 < 9.47.2"},{"id":"GHSA-2464-fhr4-w9xw","title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","aliases":[],"summary":"## Impact\n\nA memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.\n\n## Workaround\n\nEnsure the version of `sharp` used by Next.js is greater than ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"next","publishedAt":"2026-10-22T15:52:53Z","exploitedKev":false,"fixedVersion":"15.5.28","vulnerableRange":">= 10.0.0 <= 15.5.27"},{"id":"GHSA-cpvr-w4j5-2mpg","title":"Librsvg: Use-after-free when XML includes have duplicated entities","aliases":["CVE-2026-96889"],"summary":"Librsvg uses libxml2, a C library, to parse XML.  When librsvg parses\nan SVG document which has a nested Xinclude, an XML entity declaration\nwith a duplicate name as an existing one can cause a use-after-free error.\n\nWhile libxml2 is expanding an internal entity, a recursive XInc","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"librsvg","publishedAt":"2026-10-22T15:52:48Z","exploitedKev":false,"fixedVersion":"2.57.5","vulnerableRange":"< 2.57.5"},{"id":"GHSA-p3m5-59mp-jv5r","title":"Next.js: Denial of Service in App Router using Server Actions","aliases":["CVE-2026-94482"],"summary":"## Impact\n\nCrafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.\n\n## Workarounds\n\nNo workaround exists besides upgrading. Applications using Pag","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"next","publishedAt":"2026-10-22T15:50:34Z","exploitedKev":false,"fixedVersion":"15.5.28","vulnerableRange":">= 13.0.0 <= 15.5.27"},{"id":"GHSA-pxh4-856f-4h89","title":"PyJWT: HS256\/384\/512 verify accepts empty HMAC key via oct JWK (PyJWK\/PyJWKClient) enabling token forgery","aliases":[],"summary":"### Summary\n\n`HMACAlgorithm.from_jwk` accepts a symmetric (`kty=oct`) JWK whose `k` value is\nthe empty string and returns a zero-length key without raising. When a token is\nthen verified with that key object (a `PyJWK`, or a `PyJWK` resolved by\n`PyJWKSet` \/ `PyJWKClient`), the HM","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pyjwt","publishedAt":"2026-10-22T15:48:04Z","exploitedKev":false,"fixedVersion":"2.14.0","vulnerableRange":"<= 2.13.0"},{"id":"GHSA-354v-3q48-cv69","title":"Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization","aliases":["CVE-2026-114135"],"summary":"### Summary\n\nJupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels.\n\nIn Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal k","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"jupyter-server","publishedAt":"2026-10-22T15:46:31Z","exploitedKev":false,"fixedVersion":"2.6.0","vulnerableRange":">= 2.0.0 < 2.6.0"},{"id":"GHSA-9v8h-qqgm-4m35","title":"Brotli: Out-of-bounds write in the Brotli decoder (\"Node2Shell\") also affects the PyPI Brotli package","aliases":[],"summary":"A buffer overflow vulnerability in the Brotli decoder (c\/dec\/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, ","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"brotli","publishedAt":"2026-10-22T15:32:49Z","exploitedKev":false,"fixedVersion":"1.2.1","vulnerableRange":">= 1.0.3 < 1.2.1"},{"id":"GHSA-7587-9684-52r6","title":"mem0ai Databricks vector store vulnerable to SQL injection","aliases":["CVE-2026-115324"],"summary":"mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0\/vector_stores\/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and u","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mem0ai","publishedAt":"2026-10-22T12:31:17Z","exploitedKev":false,"fixedVersion":"1.0.8","vulnerableRange":">= 0.1.117 < 1.0.8"},{"id":"GHSA-c978-59m8-c77v","title":"virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax","aliases":["CVE-2026-113722"],"summary":"## Summary\n\nA destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The\napp-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not\npreserve it as literal data ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"virtualenv","publishedAt":"2026-10-21T21:30:12Z","exploitedKev":false,"fixedVersion":"21.14.9","vulnerableRange":"< 21.14.9"},{"id":"GHSA-xvh5-g6gv-559v","title":" Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags","aliases":["CVE-2026-112902"],"summary":"```\n============================================================================\nMemory disclosure and segfault in libtiff encoder via crafted TIFF tags\nLocation: src\/encode.c:1014  in PyImaging_LibTiffEncoderNew()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n==============","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-21T21:29:16Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":"<= 12.3.0"},{"id":"GHSA-332p-7hrc-92wf","title":"Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO","aliases":["CVE-2026-112393"],"summary":"```\n============================================================================\nHeap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO\nLocation: src\/libImaging\/TiffDecode.c:94  in _tiffWriteProc()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n===================","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-21T21:28:09Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 2.0.0 < 13.0.0"},{"id":"GHSA-f2g6-542v-9j58","title":"Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle","aliases":["CVE-2026-112406"],"summary":"```\n============================================================================\nInfinite loop in PdfParser.rewrite_pages on page tree Parent cycle\nLocation: src\/PIL\/PdfParser.py:505  in PdfParser.rewrite_pages()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n================","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-21T21:21:07Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 5.1.0 < 13.0.0"},{"id":"GHSA-5xm2-6676-qcp9","title":"Pillow: APNG background disposal allocates full canvas before decompression bomb check","aliases":["CVE-2026-112399"],"summary":"```\n============================================================================\nAPNG background disposal allocates full canvas before decompression bomb check\nLocation: src\/PIL\/PngImagePlugin.py:1000  in PngImageFile._seek()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n===","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-21T21:17:56Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 8.1.0 < 13.0.0"},{"id":"GHSA-gg2r-wvfm-q9rx","title":"Pillow: MSP RLE decoder expands a tiny file into unbounded memory","aliases":["CVE-2026-112892"],"summary":"### Summary\nThe MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels.\n\n### Details\nThe M","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pillow","publishedAt":"2026-10-21T21:12:56Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 4.1.0 < 13.0.0"},{"id":"GHSA-jg86-v3jv-hrpm","title":"Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)","aliases":["CVE-2026-112894"],"summary":"```\n============================================================================\nQuadratic-time DoS in PDF save_all (PdfParser.next_object_id)\nLocation: src\/PIL\/PdfParser.py:629  in next_object_id()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n==============================","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-21T21:11:44Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 5.1.0 < 13.0.0"},{"id":"GHSA-22hg-r758-rrw9","title":"Pillow: Infinite loop in MIC n_frames when the embedded TIFF","aliases":["CVE-2026-112390"],"summary":"```\n============================================================================\nInfinite loop in MIC n_frames when the embedded TIFF has 3+ IFDs\nLocation: src\/PIL\/MicImagePlugin.py:86  in MicImageFile.tell()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n====================","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-21T20:39:49Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 7.2.0 < 13.0.0"},{"id":"GHSA-27h8-gf7j-v5hc","title":"Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images","aliases":["CVE-2026-112392"],"summary":"```\n============================================================================\nNULL dereference in ImagingExpand via rank filters on zero-size images\nLocation: src\/libImaging\/Filter.c:79  in ImagingExpand()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n====================","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-21T20:32:37Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":"<= 12.3.0"},{"id":"GHSA-cp9v-662q-vvx9","title":"Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0","aliases":["CVE-2026-112405"],"summary":"### Summary\n`Image.merge()` checks the mode of every input band except band 0. If band 0 is a single-band `I` or `F` image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain `Image.open()","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pillow","publishedAt":"2026-10-21T20:30:25Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 12.0.0 < 13.0.0"},{"id":"GHSA-j4m9-6w36-pw47","title":"Pillow: Invalid free in FreeType glyph rendering when a stroker is active","aliases":["CVE-2026-112893"],"summary":"### Summary\nWhen text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If `FT_Load_Glyph` fails for a glyph, the cleanup path calls `FT_Done_Glyph` on the `glyph` variable. That variable is not initialized before the first measur","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pillow","publishedAt":"2026-10-21T20:06:34Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 10.0.0 < 13.0.0"},{"id":"GHSA-7mwm-ghpf-9vrm","title":"Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform","aliases":["CVE-2026-112402"],"summary":"```\n============================================================================\nDouble free in ImagingScaleAffine on calloc failure via Image.transform\nLocation: src\/libImaging\/Geometry.c:866  in ImagingScaleAffine()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n===========","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-21T20:03:56Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":"<= 12.3.0"},{"id":"GHSA-w889-685w-c8fh","title":"Pillow: Argument Injection in Ghostscript call, potentially leading into RCE","aliases":["CVE-2026-112900"],"summary":"### Summary\n`PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) **without sanitization**, placing it at `-f <infile>`. A filename beginning with `-` is interpreted by Ghostscript as an option, giving command-line argument i","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-21T19:58:44Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 2.6.0 < 13.0.0"},{"id":"GHSA-f2ph-cmg5-wxc8","title":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","aliases":["CVE-2026-114125"],"summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer\u2019s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer\u2019s privileges. We","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"storybook","publishedAt":"2026-10-21T17:23:29Z","exploitedKev":false,"fixedVersion":"8.6.19","vulnerableRange":">= 8.0.0 < 8.6.19"},{"id":"GHSA-vxj4-q4g9-crj7","title":"virtualenv bash activate runs commands from an environment name with a backslash before $","aliases":["CVE-2026-113725"],"summary":"### Summary\n\nThe bash `activate` script escapes the environment name for only one of the two passes bash makes over `PS1`, so a\nbackslash in the name undoes the escaping and a name containing `\\$(...)` runs as commands in the user's shell each\ntime bash draws the prompt.\n\n### Aff","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"virtualenv","publishedAt":"2026-10-21T16:49:01Z","exploitedKev":false,"fixedVersion":"21.14.7","vulnerableRange":"<= 21.14.6"},{"id":"GHSA-5vjq-rrrf-7h2q","title":"virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST","aliases":["CVE-2026-113726"],"summary":"### Impact\n\nzsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With t","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"virtualenv","publishedAt":"2026-10-21T16:46:23Z","exploitedKev":false,"fixedVersion":"21.14.4","vulnerableRange":"<= 21.14.3"},{"id":"GHSA-c947-3pg5-gm8q","title":"virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote","aliases":["CVE-2026-113732"],"summary":"### Impact\n\n`FishActivator` defines no `quote()`, so it inherits `ViaTemplateActivator.quote`, which returns `shlex.quote(string)`. That function follows POSIX `sh` rules, where a backslash inside single quotes stays a literal character. fish reads `\\'` inside single quotes as an","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"virtualenv","publishedAt":"2026-10-21T16:39:58Z","exploitedKev":false,"fixedVersion":"21.14.2","vulnerableRange":"<= 21.14.1"},{"id":"GHSA-8rjx-v5ww-45pp","title":"virtualenv activation scripts run code from a path that contains a placeholder name","aliases":["CVE-2026-113776"],"summary":"### Impact\n\n`ViaTemplateActivator.instantiate_template` replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that na","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"virtualenv","publishedAt":"2026-10-21T16:39:38Z","exploitedKev":false,"fixedVersion":"21.14.2","vulnerableRange":">= 20.26.6 <= 21.14.1"},{"id":"GHSA-46r4-q7wv-32fc","title":"OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs","aliases":["CVE-2026-113727"],"summary":"## Summary\n\nThe OpenChoreo API server authorized `PUT ...\/workflowruns\/{runName}` against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree.\n\nA `WorkflowRun`'s membership in a project","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/openchoreo\/openchoreo","publishedAt":"2026-10-21T16:29:53Z","exploitedKev":false,"fixedVersion":"1.0.6","vulnerableRange":">= 1.0.0 < 1.0.6"},{"id":"GHSA-5588-rp99-5fjh","title":"Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization","aliases":["CVE-2026-113729"],"summary":"Exclusive XML canonicalization (`http:\/\/www.w3.org\/2001\/10\/xml-exc-c14n#`) in `github.com\/moov-io\/signedxml` copied the entire accumulated namespace map at every node during `ValidateReferences()`, before any reference digest or signature check.\n\nFor a chain of nested elements th","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/moov-io\/signedxml","publishedAt":"2026-10-21T16:27:55Z","exploitedKev":false,"fixedVersion":"1.4.1","vulnerableRange":"<= 1.4.0"},{"id":"GHSA-86wm-68pq-5jwq","title":"ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms\/import-export","aliases":["CVE-2026-113711"],"summary":"## Summary\n\nA potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by `@apostrophecms\/import-export`.\n\nThe affected import API routes invoke:\n\n`self.apos.http.bigUploadMiddleware()`\n\nbefore the actual import handler performs its ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"apostrophe","publishedAt":"2026-10-21T13:51:21Z","exploitedKev":false,"fixedVersion":"4.33.0","vulnerableRange":"< 4.33.0"},{"id":"GHSA-m3wx-qqmx-qxvf","title":"Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-pjjw-68hj-v9mw. This link is maintained to preserve external references.\n\n## Original Description\nAstral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to del","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"uv","publishedAt":"2026-10-21T03:32:27Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 0.11.6"},{"id":"GHSA-f623-hjm8-5wg5","title":"Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-h3rc-6mm3-gc2m. This link is maintained to preserve external references.\n\n## Original Description\nvLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revisio","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"vllm","publishedAt":"2026-10-21T03:32:16Z","exploitedKev":false,"fixedVersion":"0.31.0","vulnerableRange":">= 0.7.3 < 0.31.0"},{"id":"GHSA-3cgq-c484-rx5j","title":"Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-gx7p-2j49-hfq4. This link is maintained to preserve external references.\n\n## Original Description\nvLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability th","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"vllm","publishedAt":"2026-10-21T03:32:16Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.7.3 < 0.31.0"},{"id":"GHSA-hfwf-hgvp-4rr8","title":"Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-p92p-rxj5-7p2x. This link is maintained to preserve external references.\n\n## Original Description\nvLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"vllm","publishedAt":"2026-10-21T03:32:14Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 0.31.0"},{"id":"GHSA-58r4-6rv3-gfh8","title":"Pillow: Out-of-bounds access in _imagingmorph on a zero-width image","aliases":["CVE-2026-112397"],"summary":"### Summary\nA PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size `(0, N)`. Passing that image to `ImageMorph.MorphOp.apply()` makes the native morphology code index a row buffer at `outrow[width - 1]`, which is `outrow[-1]` when the width i","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-20T20:56:22Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":"<= 12.3.0"},{"id":"GHSA-65qm-jvmh-6pqg","title":"Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS","aliases":["CVE-2026-112400"],"summary":"```\n============================================================================\nGIF seek keeps rejected size after DecompressionBombError, allowing DoS\nLocation: src\/PIL\/GifImagePlugin.py:293  in GifImageFile._seek()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n===========","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-20T20:53:36Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 9.2.0 < 13.0.0"},{"id":"GHSA-q45j-58j2-45rg","title":"Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips","aliases":["CVE-2026-112897"],"summary":"```\n============================================================================\nTiffDecode returns uninitialized memory as pixels for short JPEG strips\nLocation: src\/libImaging\/TiffDecode.c:554  in _decodeStrip()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n===============","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-20T20:52:43Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 5.3.0 < 13.0.0"},{"id":"GHSA-pchr-8j38-3x4p","title":"Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read","aliases":["CVE-2026-112896"],"summary":"## Summary\n\nA small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1\u00d71, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap)","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-20T20:51:40Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":"<= 12.3.0"},{"id":"GHSA-p4wg-p73j-c528","title":"Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)","aliases":["CVE-2026-112895"],"summary":"### Summary\nWhen an application appends to an existing PDF with `Image.save(..., format=\"PDF\", append=True)`, Pillow parses that file with `PdfParser`. Two recursive parsers have no effective bound. `linearize_page_tree` follows `\/Kids` with no visited set or depth limit, so a cy","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pillow","publishedAt":"2026-10-20T20:50:49Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 5.1.0 < 13.0.0"},{"id":"GHSA-c6hw-5grf-ff96","title":"Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels","aliases":["CVE-2026-112404"],"summary":"```\n============================================================================\nOOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels\nLocation: src\/libImaging\/TiffDecode.c:483  in _decodeTile()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n=============","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-20T20:42:00Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":">= 8.1.0 < 13.0.0"},{"id":"GHSA-8g5g-8vmr-9782","title":"Pillow: Heap buffer overflow in ImagingJpegDecode","aliases":["CVE-2026-112403"],"summary":"## Summary\n\n`JpegImageFile.draft()` \u2014 which `Image.thumbnail()` calls automatically \u2014 requests 1\/2, 1\/4 or 1\/8 scaled JPEG output and shrinks `self._size` and the tile extents to match, so `_setimage()` allocates a single-row decode buffer of `ceil(W\/s)` samples. `ImagingJpegDeco","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Pillow","publishedAt":"2026-10-20T20:40:07Z","exploitedKev":false,"fixedVersion":"13.0.0","vulnerableRange":"<= 12.3.0"},{"id":"GHSA-gfr2-rv44-r23c","title":"markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)","aliases":["CVE-2026-111758"],"summary":"### Summary\n\nA link reference definition whose label or title is never closed is O(n\u00b2) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src\/rules_block\/reference.ts, and the subsequent charCodeAt and slice calls flatten t","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"markdown-it","publishedAt":"2026-10-20T20:28:44Z","exploitedKev":false,"fixedVersion":"14.3.3","vulnerableRange":">= 14.1.0 < 14.3.3"},{"id":"GHSA-jm63-cq47-j5jp","title":"MCP  TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another","aliases":["CVE-2026-111770"],"summary":"### Summary\nIn affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one `McpServer` or `Server` instance.\n\nMessages were matched to a connection b","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@modelcontextprotocol\/server","publishedAt":"2026-10-20T20:07:29Z","exploitedKev":false,"fixedVersion":"2.3.0","vulnerableRange":">= 2.0.0 < 2.3.0"},{"id":"GHSA-46jr-4wx8-v453","title":"MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation","aliases":["CVE-2026-111768"],"summary":"### Summary\nIn affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with `JavaScript heap out of memory`.\n\n","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@modelcontextprotocol\/sdk","publishedAt":"2026-10-20T20:06:35Z","exploitedKev":false,"fixedVersion":"1.32.0","vulnerableRange":">= 1.3.0 < 1.32.0"},{"id":"GHSA-9xw5-w5jj-pvcg","title":"AIOHTTP: File descriptor exhaustion in multipart requests","aliases":["CVE-2026-111066"],"summary":"### Summary\n\nAn attacker can exhaust file descriptors with specially crafted multipart requests.\n\n### Impact\n\nIf a handler uses `Request.post()`, it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"aiohttp","publishedAt":"2026-10-20T19:52:09Z","exploitedKev":false,"fixedVersion":"3.14.4","vulnerableRange":">= 2.0.0 < 3.14.4"},{"id":"GHSA-587h-7wmj-h5pm","title":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","aliases":["CVE-2026-112942"],"summary":"### Summary\n\n`launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\\\..:line:column`. This removes the requirement that the attacker be able to place a fi","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"launch-editor","publishedAt":"2026-10-20T19:48:25Z","exploitedKev":false,"fixedVersion":"2.14.2","vulnerableRange":"<= 2.14.1"},{"id":"GHSA-hq85-5cpj-mr62","title":"uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised","aliases":[],"summary":"By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has r","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"uv","publishedAt":"2026-10-20T19:37:52Z","exploitedKev":false,"fixedVersion":"0.13.4","vulnerableRange":"< 0.13.4"},{"id":"GHSA-6q48-6c7w-9gw2","title":"certifi bundles emSign root CAs with compromised intermediate CA keys","aliases":[],"summary":"Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. \n\nAn attacker with one of the comprom","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"certifi","publishedAt":"2026-10-20T19:35:05Z","exploitedKev":false,"fixedVersion":"2026.10.18","vulnerableRange":">= 2019.03.09 < 2026.10.18"},{"id":"GHSA-22jm-h49p-29qw","title":"MCP TypeScript SDK: Experimental tasks were not tied to the session that created them","aliases":["CVE-2026-111767"],"summary":"### Summary\nIn affected versions, the experimental tasks feature (`taskStore`) did not check which session created a task. Clients sharing one `InMemoryTaskStore` could list, read and cancel each other's tasks.\n\nExperimental tasks are deprecated. The 2026-07-28 specification repl","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@modelcontextprotocol\/sdk","publishedAt":"2026-10-20T18:26:54Z","exploitedKev":false,"fixedVersion":"1.32.0","vulnerableRange":">= 1.24.0 < 1.32.0"},{"id":"GHSA-qhcq-9pm2-c9w9","title":"ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory","aliases":["CVE-2026-113658"],"summary":"### Summary\n\nA rejected upload can remain in the operating system temporary directory.\n\nMulter writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily c","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"apostrophe","publishedAt":"2026-10-20T18:10:32Z","exploitedKev":false,"fixedVersion":"4.33.0","vulnerableRange":"< 4.33.0"},{"id":"GHSA-j5rq-xfvr-p969","title":"ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms\/db-connect causes process-wide denial of service","aliases":["CVE-2026-113666"],"summary":"## Summary\n\n`@apostrophecms\/db-connect` ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its `unsetNestedField` helper walks an attacker-controlled dotted field path with no segment validation and calls `delete` on the resolved prop","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@apostrophecms\/db-connect","publishedAt":"2026-10-20T18:03:50Z","exploitedKev":false,"fixedVersion":"1.1.0","vulnerableRange":"< 1.1.0"},{"id":"GHSA-q3jh-wrc6-jgq8","title":"follow-redirects array-form headers bypass cross-origin credential stripping","aliases":["CVE-2026-111756"],"summary":"### Summary\nfollow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared `sensitiveHeaders`) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine ite","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"follow-redirects","publishedAt":"2026-10-20T17:58:04Z","exploitedKev":false,"fixedVersion":"1.16.1","vulnerableRange":">= 1.16.0 < 1.16.1"},{"id":"GHSA-8r9p-f939-6h3c","title":"follow-redirects sensitiveHeaders regex escaping can expose credential headers","aliases":["CVE-2026-111755"],"summary":"### Summary\nfollow-redirects 1.16.0 introduced the `sensitiveHeaders` option (the fix for CVE-2026-40895 \/ GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filte","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"follow-redirects","publishedAt":"2026-10-20T17:53:05Z","exploitedKev":false,"fixedVersion":"1.16.1","vulnerableRange":">= 1.16.0 < 1.16.1"},{"id":"GHSA-57xq-rjx2-v5xh","title":"@angular\/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)","aliases":["CVE-2026-111751"],"summary":"A denial of service (DoS) vulnerability was identified in `@angular\/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8) and `RouterLink` directives are rendered with `queryParamsHandling: 'merge'` or `'preserve'`, configured either per link or globally via `defaul","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@angular\/router","publishedAt":"2026-10-20T17:52:32Z","exploitedKev":false,"fixedVersion":"22.2.1","vulnerableRange":">= 22.0.0 < 22.2.1"},{"id":"GHSA-62vg-58rm-qff7","title":"@angular\/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)","aliases":["CVE-2026-111752"],"summary":"A denial of service (DoS) vulnerability was identified in `@angular\/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8).\n\nDuring route recognition, `@angular\/router` fails to validate whether an auxiliary outlet segment in the URL matches a route configured for th","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@angular\/router","publishedAt":"2026-10-20T14:36:39Z","exploitedKev":false,"fixedVersion":"22.2.1","vulnerableRange":">= 22.0.0 < 22.2.1"},{"id":"GHSA-r7fv-28h4-cvq7","title":"markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes","aliases":["CVE-2026-111759"],"summary":"### Impact\n\nWhen `typographer: true` is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input.\n\nMany opening double quotes followed by unmatched closing ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"markdown-it","publishedAt":"2026-10-20T14:34:50Z","exploitedKev":false,"fixedVersion":"15.0.2","vulnerableRange":">= 15.0.0 < 15.0.2"},{"id":"GHSA-259r-337f-4rfw","title":"Compress\/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress","aliases":["CVE-2026-63209"],"summary":"# Signed Integer Overflow in s2.NewDict\n\n## Summary\n\nA signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subseque","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/klauspost\/compress","publishedAt":"2026-10-20T14:33:33Z","exploitedKev":false,"fixedVersion":"1.18.7","vulnerableRange":"<= 1.18.6"},{"id":"GHSA-wqmh-qccw-pqwf","title":"MLflow FileStore trace IDs allow path traversal and arbitrary file writes","aliases":["CVE-2026-53995"],"summary":"MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST \/api\/3.0\/mlflow\/traces endpoint. Attac","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mlflow","publishedAt":"2026-10-20T00:31:59Z","exploitedKev":false,"fixedVersion":"3.17.2","vulnerableRange":"<= 3.17.1"},{"id":"GHSA-5wr8-gcqf-gqf3","title":"aiohttp server lacks an initial request\/header timeout","aliases":["CVE-2026-111064"],"summary":"### Summary\n\nThe keepalive timeout was not used during the initial portion of a request.\n\n### Impact\n\nAn attacker could keep an idle connection open indefinitely before sending any data.\n\n### Workaround\n\nUse a reverse proxy (as recommended for all production deployments) with sen","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"aiohttp","publishedAt":"2026-10-19T17:08:04Z","exploitedKev":false,"fixedVersion":"3.14.4","vulnerableRange":"<= 3.14.3"},{"id":"GHSA-2g87-pp6c-29x5","title":"aiohttp: Multiple instances of excessive or unbounded memory\/CPU use","aliases":[],"summary":"### Summary\n\nMultiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests.\n\n### Impact\n\nAn attacker could cause resource exhaustion through specially crafted requests.","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"aiohttp","publishedAt":"2026-10-19T17:07:23Z","exploitedKev":false,"fixedVersion":"3.14.4","vulnerableRange":"<= 3.14.3"},{"id":"GHSA-f8c7-rwf9-fmgm","title":"Mercury: Unauthenticated Remote Code Execution in \/api\/terminals - access control bypass","aliases":["CVE-2026-111057"],"summary":"### Summary\nA missing comma in `mercury_app\/block_handler.py`'s `BLOCKED_PATTERNS` list causes the blocklist to fail to cover the `\/api\/terminals` endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury.\n\n### De","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mercury","publishedAt":"2026-10-19T17:00:54Z","exploitedKev":false,"fixedVersion":"3.2.4","vulnerableRange":">= 3.0.0 <= 3.2.3"},{"id":"GHSA-rv4m-xm3f-3ccq","title":"Mercury: Unauthenticated Remote Code Execution via \/api\/kernels","aliases":["CVE-2026-111058"],"summary":"Mercury runs a JupyterLab server with **anonymous access by default** (`mercury_app\/__main__.py` sets `--IdentityProvider.token=''` when no `--token`\/`MERCURY_TOKEN` is given; when tokenless it also sets `--ServerApp.disable_check_xsrf=True`). It relies on a **blocklist** (`mercu","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mercury","publishedAt":"2026-10-19T16:49:08Z","exploitedKev":false,"fixedVersion":"3.2.6","vulnerableRange":"<= 3.2.5"},{"id":"GHSA-vx2m-gpq4-8j5q","title":"LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files","aliases":["CVE-2026-108372"],"summary":"## Summary\n\n`loopx serve-status` sends `Access-Control-Allow-Origin: *` on **every** response,\nincluding its unauthenticated `GET` routes. Because the endpoint is unauthenticated and\nbound to a fixed, well-known loopback port, **any website the operator visits can read\nLoopX cont","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"loopx","publishedAt":"2026-10-19T16:11:57Z","exploitedKev":false,"fixedVersion":"0.4.5","vulnerableRange":">= 0.0.1 < 0.4.5"},{"id":"GHSA-pw5q-rjx4-7f7p","title":"Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)","aliases":["CVE-2026-96627"],"summary":"## Summary\nA user holding the delegated `users:update` permission can reset the global administrator's password and take over the admin account. `UpdateUser` sets the target user's `PasswordHash` from the request body for ANY target with no comparison of caller-vs-target privileg","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/getarcaneapp\/arcane\/backend\/v2","publishedAt":"2026-10-16T21:15:03Z","exploitedKev":false,"fixedVersion":"2.6.0","vulnerableRange":"< 2.6.0"},{"id":"GHSA-w5f2-9q9c-ff4h","title":"LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport","aliases":["CVE-2026-105192"],"summary":"### Summary\n\nLMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport\n\n\n\n### Details\n\nLMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can registe","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lmcache","publishedAt":"2026-10-16T20:08:44Z","exploitedKev":false,"fixedVersion":"0.5.6","vulnerableRange":">= 0.3.9 < 0.5.6"},{"id":"GHSA-74vm-87hj-r66f","title":"kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content","aliases":["CVE-2026-100349"],"summary":"## Summary\n\n`ValidateResponse` panics on a nil pointer when a spec declares a response header with `content` instead of `schema`. `doc.Validate()` accepts that document, so the crash comes from a spec the library just called valid.\n\nSame class as GHSA-jpcw-4wr7-c3vq, which covere","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/getkin\/kin-openapi","publishedAt":"2026-10-16T19:58:46Z","exploitedKev":false,"fixedVersion":"0.146.0","vulnerableRange":"<= 0.145.0"},{"id":"GHSA-6fj4-rcr3-r7rr","title":"lopdf has a stack overflow via deeply nested PDF objects","aliases":[],"summary":"`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`\/X [[[ \u2026 ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"lopdf","publishedAt":"2026-10-16T19:55:39Z","exploitedKev":false,"fixedVersion":"0.42.0","vulnerableRange":"< 0.42.0"},{"id":"GHSA-h4mw-j7qp-8mwm","title":"Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution","aliases":["CVE-2026-96620"],"summary":"The Claude Agent SDK for Python passed the `resume` option to the Claude CLI without validation, allowing a value beginning with `-` to be interpreted as a separate CLI flag. An attacker who controlled the `resume` value could inject an `--mcp-config` flag defining a stdio MCP se","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"claude-agent-sdk","publishedAt":"2026-10-16T19:44:37Z","exploitedKev":false,"fixedVersion":"0.2.121","vulnerableRange":"< 0.2.121"},{"id":"GHSA-cv23-7vc5-jfh7","title":"gomarkdown\/markdown IsSafeURL panics on short URLs","aliases":["CVE-2026-102941"],"summary":"## Summary\n\nIsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/gomarkdown\/markdown","publishedAt":"2026-10-16T15:41:39Z","exploitedKev":false,"fixedVersion":"0.0.0-20260724235538-61af6e1e6971","vulnerableRange":"< 0.0.0-20260724235538-61af6e1e6971"},{"id":"GHSA-qx66-fv34-fjm8","title":"TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses","aliases":["CVE-2026-102989"],"summary":"## Impact\n\nAn unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin dat","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@tanstack\/start-server-core","publishedAt":"2026-10-15T20:22:20Z","exploitedKev":false,"fixedVersion":"1.169.39","vulnerableRange":">= 1.143.12 < 1.169.39"},{"id":"GHSA-2cvf-wqm6-wr9g","title":"Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation","aliases":["CVE-2026-94603"],"summary":"### Impact\nPodman v4.4.0 added a feature where container checkpoints (from the `podman container checkpoint` command) could be distributed via OCI registry, and pulled from that registry and run via the `podman run` command. This allowed easy transfer of checkpoints between syste","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/containers\/podman","publishedAt":"2026-10-15T20:22:16Z","exploitedKev":false,"fixedVersion":"5.8.8","vulnerableRange":">= 4.4.0 < 5.8.8"},{"id":"GHSA-pq7j-f95f-qfcv","title":"Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning","aliases":["CVE-2026-86063"],"summary":"The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using `git checkout` without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identi","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@anthropic-ai\/claude-code","publishedAt":"2026-10-15T20:22:07Z","exploitedKev":false,"fixedVersion":"2.1.179","vulnerableRange":"< 2.1.179"},{"id":"GHSA-x586-xvc8-g7q6","title":"Qwik: Crashing any Qwik Server via Resource thenable","aliases":["CVE-2026-84994"],"summary":"### Summary\n\nA Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, `ResourceSerializer.$fill$` does `Promise.resolve(resource._resolved)`. If `_resolved` is a plain object whose `.then` is a QRL for an unre","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@builder.io\/qwik","publishedAt":"2026-10-15T20:22:00Z","exploitedKev":false,"fixedVersion":"1.20.0","vulnerableRange":"< 1.20.0"},{"id":"GHSA-p7v4-vr35-mj6f","title":"containerd CRI plugin: Checkpoint restore bypasses destination security context","aliases":["CVE-2026-95837"],"summary":"### Impact\n\nA vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the `CreateContainer` API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint arch","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/containerd\/containerd\/v2","publishedAt":"2026-10-15T20:21:57Z","exploitedKev":false,"fixedVersion":"2.2.7","vulnerableRange":">= 2.1.0 < 2.2.7"},{"id":"GHSA-vrcc-3ch7-hppw","title":"kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter","aliases":["CVE-2026-100353"],"summary":"## Summary\n\nThe fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the `items` keyword (which is legal under JSON Schema 2020-12). That fix patched three decoder paths: the standalone `parseArray` function, the top-l","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/getkin\/kin-openapi","publishedAt":"2026-10-15T20:20:47Z","exploitedKev":false,"fixedVersion":"0.149.0","vulnerableRange":">= 0.136.0 < 0.149.0"},{"id":"GHSA-g8cf-rcjf-c8cf","title":"kin-openapi: Uncontrolled Recursion on Circular allOf\/anyOf\/oneOf Schemas Causes Fatal Process Crash","aliases":["CVE-2026-100354"],"summary":"## Summary\n\nkin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader resolves circular `$ref`s on purpose (to support recursive data structures), and `Schema.validate()` uses stack-based cycle detection. `Validate()` therefore ac","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/getkin\/kin-openapi","publishedAt":"2026-10-15T20:20:37Z","exploitedKev":false,"fixedVersion":"0.149.0","vulnerableRange":"< 0.149.0"},{"id":"GHSA-rj39-cv6w-8wv7","title":"kin-openapi: YAML NaN\/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path","aliases":["CVE-2026-100352"],"summary":"## Summary\n\nkin-openapi guards against `NaN` and `Inf` values in its built-in schema visitor (`visitJSON`) by returning `ErrSchemaInputNaN` \/ `ErrSchemaInputInf` when a `float64` input violates those constraints. For OAS 3.1 specs, however, `Schema.VisitJSON` routes through `useJ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/getkin\/kin-openapi","publishedAt":"2026-10-15T20:20:27Z","exploitedKev":false,"fixedVersion":"0.148.0","vulnerableRange":"< 0.148.0"},{"id":"GHSA-637c-6jxx-4rwm","title":"KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication","aliases":["CVE-2026-77524"],"summary":"## Summary\n\nA namespace admin who creates a `TriggerAuthentication` and a `ScaledObject` in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds `[\"*\"]\/[\"*\"] get` cluster-wide, so it reads every Secret in ev","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/kedacore\/keda","publishedAt":"2026-10-15T20:19:42Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 1.5.0"},{"id":"GHSA-fmxq-cgp8-87wp","title":"Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete\/PostDelete resource hooks","aliases":["CVE-2026-77459"],"summary":"### Impact\n\nArgo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete ","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/argoproj\/argo-cd\/v2","publishedAt":"2026-10-15T20:19:31Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 2.10.0 <= 2.14.21"},{"id":"GHSA-23vg-4cjm-66q5","title":"kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion","aliases":["CVE-2026-100351"],"summary":"## Summary\n\n`openapi3filter.ValidationHandler.Middleware` validates requests with kin-openapi's\nlegacy router, which selects an OpenAPI operation from the decoded `URL.Path`. The\nmethod is documented as implementing `gorilla\/mux.MiddlewareFunc`, but a downstream\ngorilla\/mux route","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/getkin\/kin-openapi","publishedAt":"2026-10-15T20:19:20Z","exploitedKev":false,"fixedVersion":"0.147.0","vulnerableRange":">= 0.144.0 < 0.147.0"},{"id":"GHSA-qj98-gp63-54xj","title":"Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service","aliases":["CVE-2026-102748"],"summary":"### Summary\n\nDgraph `v25.3.8` exposes a Zero HTTP administrative surface that is unauthenticated when port `6080` is reachable.\n\nThe exposed routes include:\n\n- `\/state`\n- `\/assign`\n- `\/removeNode`\n- `\/moveTablet`\n\nAn unauthenticated request to `\/removeNode?id=1&group=0` on a sing","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/dgraph-io\/dgraph\/v25","publishedAt":"2026-10-15T20:17:22Z","exploitedKev":false,"fixedVersion":"25.4.0","vulnerableRange":"<= 25.3.8"},{"id":"GHSA-v75v-6fpf-gvw8","title":"Vitess vttablet \/twopcz reflected XSS","aliases":["CVE-2026-104252"],"summary":"From: xylove21\nTo: security@vitess.io\nSubject: [Security Report] Vitess vttablet \/twopcz reflected XSS\nDate: Tue, 24 Jun 2026 14:30:00 +0800\n\n## Summary\n\nThe `twopczHandler` in\n`go\/vt\/vttablet\/tabletserver\/twopcz.go` (line 185) reflects the `Action`\nand `dtid` form values directl","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"vitess.io\/vitess","publishedAt":"2026-10-15T20:16:29Z","exploitedKev":false,"fixedVersion":"0.23.5","vulnerableRange":"< 0.23.5"},{"id":"GHSA-g74g-rg72-j2p3","title":"mise permits untrusted local configuration to override default shell arguments","aliases":["CVE-2026-103929"],"summary":"## Summary\n\nUntrusted local .mise.toml [settings] can set the shell interpreter args (unix\/windows default_inline \/ default_file shell_args), yielding arbitrary command execution, because those command-interpreter settings were not added to the global_only denylist the CVE-2026-5","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"mise","publishedAt":"2026-10-15T20:16:09Z","exploitedKev":false,"fixedVersion":"2026.7.14","vulnerableRange":"<= 2026.7.13"},{"id":"GHSA-2vc4-c4r6-p6v6","title":"OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths","aliases":["CVE-2026-100409"],"summary":"## Summary\n\nWhen cache interception is enabled, `@opennextjs\/cloudflare` can interpret percent-encoded paths differently during middleware matching and cache lookup.\n\nAn encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@opennextjs\/cloudflare","publishedAt":"2026-10-15T20:15:17Z","exploitedKev":false,"fixedVersion":"1.20.2","vulnerableRange":">= 0.3.0 < 1.20.2"},{"id":"GHSA-p6wj-qrr4-pgh5","title":"kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items","aliases":["CVE-2026-97394"],"summary":"### Summary\n\nA nil-pointer dereference in `openapi3filter` lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI **3.1** operation that declares `type: array` **without** `items`. OpenAPI 3.1 (JSON Schema 2020-12) permits omitting `","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/getkin\/kin-openapi","publishedAt":"2026-10-15T20:14:54Z","exploitedKev":false,"fixedVersion":"0.143.0","vulnerableRange":">= 0.136.0 < 0.143.0"},{"id":"GHSA-54mm-6729-r5wp","title":"Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods","aliases":["CVE-2026-85990"],"summary":"### Summary\n\nAny authenticated Leantime user - including the lowest-privilege `readonly` role - can escalate to full administrative access by calling the JSON-RPC method `leantime.rpc.api.api.createApiKeyWithProjects` with an attacker-chosen `role` value. The server creates a new","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"leantime\/leantime","publishedAt":"2026-10-15T20:14:43Z","exploitedKev":false,"fixedVersion":"3.10.0","vulnerableRange":"< 3.10.0"},{"id":"GHSA-v3ph-cgqh-r8p5","title":"FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module","aliases":["CVE-2026-82416"],"summary":"## Summary\nIn worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's `session` extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting `Cookie: session=A` can ha","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/dunglas\/frankenphp","publishedAt":"2026-10-15T20:14:29Z","exploitedKev":false,"fixedVersion":"1.12.5","vulnerableRange":"<= 1.12.4"},{"id":"GHSA-vc32-4gwf-77xp","title":"Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools","aliases":["CVE-2026-84360"],"summary":"### Summary\nAn OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through `\/mcp` and `\/mcp_message` using only ordinary authentication.\n\n### Details\nThe HTTP configuration mut","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-15T20:14:10Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260703131214-23d1934099b0","vulnerableRange":"< 1.9.10-0.20260703131214-23d1934099b0"},{"id":"GHSA-cf23-7qxj-xmhr","title":"Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line \";\" separation \u2192 authenticated directive injection (RCE on the official image)","aliases":["CVE-2026-84316"],"summary":"## Summary\n`config.ValidateConfigFile` is the security control that blocks dangerous nginx directives\n(`js_*`, `perl_*`, `load_module` of njs\/perl modules, `user root`). Its directive scanner is\nbypassable: it splits the config by newlines and inspects only the FIRST token of eac","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-15T20:13:52Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260703131214-23d1934099b0","vulnerableRange":"< 1.9.10-0.20260703131214-23d1934099b0"},{"id":"GHSA-44xr-mrhh-qm78","title":"Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)","aliases":["CVE-2026-84312"],"summary":"## Summary\n\nIn the Casdoor SSO flow, the OAuth `state` parameter is hard-coded to `settings.CasdoorSettings.Application` \u2014 a value identical for every user and every login. The callback handler accepts whatever `state` the client sends without comparing it to anything stored in t","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"Nginx-UI","publishedAt":"2026-10-15T20:12:52Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 1.9.10-0.20260703131214-23d1934099b0"},{"id":"GHSA-5v7c-xpfp-p65m","title":"Nginx UI OTP secure-session step-up is missing on sensitive mutation routes","aliases":["CVE-2026-84315"],"summary":"Reporter: Jagadesh Achanta\n\nTarget: `0xJacky\/nginx-ui`\n\nAffected version \/ commit tested:\n- App version: `2.3.10`\n- Commit: `4948fba8744e82c3d7003f68ee164e9f49421066`\n- Disclosure channel: GitHub Private Vulnerability Reporting\n- Credential reference: `cred:github-jagstack-gh-cli","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-15T20:12:42Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260703131214-23d1934099b0","vulnerableRange":"< 1.9.10-0.20260703131214-23d1934099b0"},{"id":"GHSA-2gc7-j998-5xx6","title":"Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint","aliases":["CVE-2026-84314"],"summary":"### Summary\n`POST \/api\/users\/:id` allows any authenticated user to change any other user's password without `RequireSecureSession` (2FA verification). In contrast, the self password change endpoint `POST \/api\/user\/password` correctly requires `RequireSecureSession`. This inconsis","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-15T20:11:45Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260703131214-23d1934099b0","vulnerableRange":"< 1.9.10-0.20260703131214-23d1934099b0"},{"id":"GHSA-gfrc-g87h-7h5w","title":"Nginx UI: TOTP \/ passkey enrolment requires no re-authentication, enabling persistent account takeover","aliases":["CVE-2026-84313"],"summary":"## Summary\n\nEndpoints that bind a TOTP secret (`POST \/api\/otp_enroll`) or register a WebAuthn passkey (`POST \/api\/finish_passkey_register`) for the *current* user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered **outside**","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"Nginx-UI","publishedAt":"2026-10-15T20:11:32Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260703131214-23d1934099b0","vulnerableRange":"< 1.9.10-0.20260703131214-23d1934099b0"},{"id":"GHSA-9jww-cxg5-rj9m","title":"Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation \u2014 Authenticated RCE","aliases":["CVE-2026-84318"],"summary":"### Summary\n\nThe MCP tool `nginx_config_add` writes nginx configuration files to disk and triggers an nginx reload without calling `config.ValidateConfigFile`. The identical flow in the REST API (`POST \/api\/configs`) does call that function and correctly rejects dangerous directi","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-15T20:11:18Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260703131214-23d1934099b0","vulnerableRange":">= 1.9.10-0.20250506154222-1330888280a2 < 1.9.10-0.20260703131214-23d1934099b0"},{"id":"GHSA-76pm-mq2q-9gcr","title":"Nginx UI: MCP nginx_config_add skips config directive validation \u2192 authenticated nginx directive injection (RCE on the official image)","aliases":["CVE-2026-84317"],"summary":"## Summary\n`internal\/config\/validation.go` (`ValidateConfigFile`) is a security control that blocks dangerous\nnginx directives \u2014 `js_*`, `perl_*`, `load_module` of the njs\/perl modules, and `user root`. It is\nenforced on three of the four config-write paths: `api\/config\/add.go`, ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-15T20:11:07Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260703131214-23d1934099b0","vulnerableRange":"< 1.9.10-0.20260703131214-23d1934099b0"},{"id":"GHSA-5r62-gj48-897x","title":"Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context","aliases":["CVE-2026-84319"],"summary":"## Summary\n\nThe regular HTTP configuration API rejects restricted Nginx directives such as `load_module`, `js_import`, and `js_content`.\n\nHowever, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content.","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-15T20:10:44Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260703131214-23d1934099b0","vulnerableRange":"< 1.9.10-0.20260703131214-23d1934099b0"},{"id":"GHSA-g4f2-2pf3-2pwj","title":"react\/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS","aliases":["CVE-2026-104827"],"summary":"### Summary\n\n`React\\Http\\Browser` and its lower-level HTTP stack impose no limit on the size of a response's header section while it is being received. `ClientRequestStream::handleData()` appends every incoming byte to an internal buffer and only scans that buffer for the `\\r\\n\\r","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"react\/http","publishedAt":"2026-10-15T20:09:56Z","exploitedKev":false,"fixedVersion":"1.11.1","vulnerableRange":">= 1.0.0 <= 1.11.0"},{"id":"GHSA-663m-7x7m-g4fw","title":"Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder","aliases":["CVE-2026-77622"],"summary":"### Summary\nSliver is vulnerable to a Denial of Service (DOS) attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/BishopFox\/sliver","publishedAt":"2026-10-15T20:09:33Z","exploitedKev":false,"fixedVersion":"1.7.6","vulnerableRange":"< 1.7.6"},{"id":"GHSA-wxxx-r42m-9rp8","title":"Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-39m8-27wv-hr27. This link is maintained to preserve external references.\n\n## Original Description\nNodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessagePa","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nodemailer","publishedAt":"2026-10-15T00:31:19Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.0.0 <= 10.0.9"},{"id":"GHSA-6wfj-92cw-88vg","title":"git-diff: OS command injection vulnerability via crafted strings to the gitDiff API","aliases":["CVE-2026-110634"],"summary":"git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evalua","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"git-diff","publishedAt":"2026-10-14T15:32:27Z","exploitedKev":false,"fixedVersion":"2.0.7","vulnerableRange":"< 2.0.7"},{"id":"GHSA-m687-p538-r5hp","title":"Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted","aliases":[],"summary":"## Summary\n\nVikunja ships with `cors.origins` defaulting to `http:\/\/127.0.0.1:*` and `http:\/\/localhost:*`, and sends `Access-Control-Allow-Credentials: true`, so a page served from any port on the user's own machine may make credentialed cross-origin requests to the API and read ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:57:50Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 2.2.0 <= 2.6.0"},{"id":"GHSA-j3hg-9rp3-5hw9","title":"Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage","aliases":["CVE-2026-107805"],"summary":"## Summary\n\nIn Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-09T20:57:08Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260901043436-8c9b9a1aff21","vulnerableRange":">= 1.9.10-0.20260729084040-acb59fdd81db < 1.9.10-0.20260901043436-8c9b9a1aff21"},{"id":"GHSA-pwhx-cvv3-qj5c","title":"Tina: Code injection via unescaped Git branch name in generated client source","aliases":["CVE-2026-108259"],"summary":"### Summary\n\n`@tinacms\/cli` inserts the raw Git branch value into the generated `client.ts` source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the ge","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@tinacms\/cli","publishedAt":"2026-10-09T20:56:52Z","exploitedKev":false,"fixedVersion":"3.0.0","vulnerableRange":"<= 2.7.0"},{"id":"GHSA-x34j-47hf-4xg7","title":"TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment","aliases":["CVE-2026-108261"],"summary":"### Summary\n\nThe TinaCMS admin builds its preview `<iframe src>` from the `\/~\/*` hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash (`#\/~\/\/attacker.example\/p`) becomes the protocol-relative URL `\/\/attacker.example\/p`, so the admin","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"tinacms","publishedAt":"2026-10-09T20:56:48Z","exploitedKev":false,"fixedVersion":"3.14.0","vulnerableRange":"<= 3.13.0"},{"id":"GHSA-c42q-qvc3-j6vg","title":"@tinacms\/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS","aliases":["CVE-2026-108260"],"summary":"### Summary\n\n`<tina-markdown>` renders a rich-text AST into the DOM and, for `a` nodes, assigns the node's URL straight to the anchor's `href` with no scheme check. A link authored in the CMS as `javascript:\u2026` renders as a live `javascript:` anchor, so a visitor who clicks it exe","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@tinacms\/web-components","publishedAt":"2026-10-09T20:56:45Z","exploitedKev":false,"fixedVersion":"0.2.1","vulnerableRange":"<= 0.2.0"},{"id":"GHSA-628f-v4f6-p37r","title":"Contao: Cross-site scripting in the comments bundle","aliases":["CVE-2026-107845"],"summary":"An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it. No `Content-Security-Policy` header is sent on the Contao back end, ","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"contao\/comments-bundle","publishedAt":"2026-10-09T20:53:50Z","exploitedKev":false,"fixedVersion":"5.3.50","vulnerableRange":">= 4.0.0 < 5.3.50"},{"id":"GHSA-wq92-8x3r-fm38","title":"Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API","aliases":["CVE-2026-91970"],"summary":"# Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API\n\n## Summary\n\nThe always-registered Planka migration lets any ordinary user select a Planka server. Although Vikunja caps each JSON response, pagination loop, and attachment indepe","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:53:24Z","exploitedKev":false,"fixedVersion":"2.6.0","vulnerableRange":">= 2.5.0 < 2.6.0"},{"id":"GHSA-pqf9-h8g4-8gmh","title":"Vikunja: Unbounded CSV row cardinality permits API process termination","aliases":["CVE-2026-91969"],"summary":"# Unbounded CSV row cardinality permits API process termination\n\n## Summary\n\nThe authenticated v2 CSV migration route caps upload bytes but not parsed row cardinality. It reads every record into a [][]string and then materializes a full task object for every row before insertion.","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:53:14Z","exploitedKev":false,"fixedVersion":"2.6.0","vulnerableRange":"= 2.5.0"},{"id":"GHSA-xxc3-xpmc-vmvr","title":"Vikunja: Unbounded nested task-filter recursion permits API process termination","aliases":["CVE-2026-91968"],"summary":"# Unbounded nested task-filter recursion permits API process termination\n\n## Summary\n\nAuthenticated task-list routes accept a filter expression without a length or nesting-depth bound, preprocess it, parse it recursively through fexpr, and recursively convert the resulting expres","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:53:03Z","exploitedKev":false,"fixedVersion":"2.6.0","vulnerableRange":"= 2.5.0"},{"id":"GHSA-w7jp-mf2v-8342","title":"Vikunja: Denial of service via decompression bomb in the data import","aliases":["CVE-2026-91979"],"summary":"### Summary\nVikunja lets you export your data as a zip and import it back. The import doesn't limit how large the archive expands to, how many files it contains, or how much storage one user can consume, and it appears to hold the whole archive in memory while processing it. Beca","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:52:52Z","exploitedKev":false,"fixedVersion":"2.6.0","vulnerableRange":"<= 2.5.0"},{"id":"GHSA-4vh2-39rq-rq8j","title":"Vikunja: Unbounded image decode on avatar and project-background uploads enables decode\/resize amplification","aliases":["CVE-2026-91971"],"summary":"### Summary\nThe 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a ti","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:52:15Z","exploitedKev":false,"fixedVersion":"2.6.0","vulnerableRange":"<= 2.5.0"},{"id":"GHSA-qfwc-vx6f-3g6g","title":"Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level","aliases":["CVE-2026-91985"],"summary":"## Summary\n\nA user who has only read permission on a project can call the single link-share read endpoint and receive the share's `hash` field \u2014 the secret credential that the anonymous `POST \/shares\/{share}\/auth` endpoint exchanges for a link-share JWT carrying the share's permi","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:51:29Z","exploitedKev":false,"fixedVersion":"2.6.0","vulnerableRange":"<= 2.5.0"},{"id":"GHSA-6rvj-qwjf-3m4q","title":"Vikunja: Every \/api\/v2 pre-auth endpoint is unthrottled on a stock install while its \/api\/v1 twin is rate limited","aliases":["CVE-2026-91972"],"summary":"### Summary\n`registerAPIRoutesV2` never applies the unconditional pre-auth rate-limit floor (`unauthRateLimit()`) to the v2 public routes \u2014 it passes that limiter only to `\/api\/v2\/ws` \u2014 and otherwise relies on `setupRateLimit`, which registers nothing when `ratelimit.enabled` is ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:51:05Z","exploitedKev":false,"fixedVersion":"2.6.0","vulnerableRange":"<= 2.5.0"},{"id":"GHSA-r6w9-259g-gwrv","title":"Vikunja: Plaintext storage of password-reset\/email-confirm tokens in database enables account takeover on DB read access","aliases":["CVE-2026-62376"],"summary":"### Summary\n\nVikunja stores password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in **plaintext**. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:49:13Z","exploitedKev":false,"fixedVersion":"2.4.0","vulnerableRange":"<= 2.3.0"},{"id":"GHSA-xv7q-fvmc-jx96","title":"Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover","aliases":["CVE-2026-62367"],"summary":"## Summary\n\nWith the per-provider OIDC `emailfallback` option enabled, Vikunja links an SSO login to a pre-existing **local** (username+password) account using only the `email` claim \u2014 no `email_verified` (or Microsoft `xms_edov`) check and no password check, on the unauthenticat","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:49:06Z","exploitedKev":false,"fixedVersion":"2.4.0","vulnerableRange":">= 1.0.0 <= 2.3.0"},{"id":"GHSA-p393-cf76-4jmr","title":"Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite","aliases":["CVE-2026-107806"],"summary":"## Summary\n\nAn authenticated nginx-ui user can call `POST \/api\/restore`, upload a forged encrypted backup, restore `app.ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST \/api\/nginx\/test`.\n\nThis was validated on nginx-ui `2.3.1","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-09T20:45:02Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260728074146-a467ed652591","vulnerableRange":">= 1.9.10-0.20260421071512-7864e378f5cf < 1.9.10-0.20260728074146-a467ed652591"},{"id":"GHSA-4jfq-pmq9-257h","title":"ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service","aliases":["CVE-2026-107839"],"summary":"### Summary\nThe AoE3 `POST \/game\/cloud\/getFileURL` handler in `luskaner\/ageLANServer`'s bundled game server decodes an attacker-controlled `names` JSON array and immediately allocates response storage sized directly from the array's length (`make(i.A, len(req.Names.Data))`), with","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/luskaner\/ageLANServer\/server","publishedAt":"2026-10-09T20:44:54Z","exploitedKev":false,"fixedVersion":"1.8.2-0.20260809203301-1dd40166a593","vulnerableRange":"< 1.8.2-0.20260809203301-1dd40166a593"},{"id":"GHSA-32r8-5843-4qw2","title":"Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure","aliases":["CVE-2026-76216"],"summary":"## Summary\nVikunja's `web.Auth` interface (`pkg\/web\/web.go`, single method `GetID() int64`) is satisfied by BOTH `*user.User` and `*models.LinkSharing`. A link-share's `GetID()` returns the **raw positive** `share.ID` (`pkg\/models\/link_sharing.go:83-85`), which lives in the same ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:43:40Z","exploitedKev":false,"fixedVersion":"2.5.0","vulnerableRange":"< 2.5.0"},{"id":"GHSA-6r69-c6wg-7g8m","title":"yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels","aliases":["CVE-2026-107840"],"summary":"The Prometheus metrics middleware in pkg\/server\/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/jhaals\/yopass","publishedAt":"2026-10-09T20:42:58Z","exploitedKev":false,"fixedVersion":"0.0.0-20260727191436-61e31ead04a4","vulnerableRange":"< 0.0.0-20260727191436-61e31ead04a4"},{"id":"GHSA-rj9j-8772-4h6c","title":"Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames\/IDs instance-wide (BOLA)","aliases":["CVE-2026-68582"],"summary":"## Summary\n\nThe task-collection endpoint `GET \/api\/v1\/projects\/{project}\/views\/{view}\/tasks` loads the requested project view straight from the URL path without verifying the caller is authorized for it. For a **link-share token**, the task query is correctly pinned to the share'","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:42:33Z","exploitedKev":false,"fixedVersion":"2.4.0","vulnerableRange":">= 0.24.0 <= 2.3.0"},{"id":"GHSA-vvcv-vpph-h844","title":"Vikunja: Link-share principal ID collision allows cross-account API token issuance and management","aliases":["CVE-2026-68581"],"summary":"Executive Summary\n\nVikunja accepts both regular-user JSON Web Tokens (JWTs) and link-share JWTs through its generic authenticated API route group. A link-share JWT resolves to a `models.LinkSharing` principal whose `GetID()` method returns the numeric `link_shares.id`. The API-to","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:42:14Z","exploitedKev":false,"fixedVersion":"2.4.0","vulnerableRange":">= 0.22.0 <= 2.3.0"},{"id":"GHSA-v3p6-34mc-hj7v","title":"Vikunja: Scoped API token can mint unrestricted OAuth session credentials","aliases":["CVE-2026-57458"],"summary":"## Summary\n\nA scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials.\n\nA token limited to:\n\n```json\n{\"oauth\":[\"authorize\"]}\n```\n\ncan call `\/api\/v1\/oauth\/authorize`, receive an OAuth authorization code, exchang","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-10-09T20:40:28Z","exploitedKev":false,"fixedVersion":"2.4.0","vulnerableRange":"= 2.3.0"},{"id":"GHSA-68w4-83fh-f2w8","title":"pyload-ng: getUserData\/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password","aliases":[],"summary":"## Summary\n\n`Api.getUserData` (legacy) and `Api.get_userdata` are declared with `@permission(Perms.ANY)` and are reachable at `\/api\/getUserData` and `\/api\/get_userdata`. Because `Perms.ANY == 0` and pyLoad's permission check is a bitmask AND, that gate is a no-op: **every authent","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pyload-ng","publishedAt":"2026-10-09T17:09:15Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.5.0b3.dev1 <= 0.5.0b3.dev101"},{"id":"GHSA-jq7h-wrvp-3rgx","title":"pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session","aliases":[],"summary":"An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carrying those privileges is never invalidated.\n\npyLoad authorizes each request from values copied into the Flask session at login. set_session in webui\/app\/helpers.py","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pyload-ng","publishedAt":"2026-10-09T17:09:09Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 0.5.0b3.dev101"},{"id":"GHSA-889w-m37p-88m5","title":"pyLoad: Api.set_user_permission never invalidates the target's session","aliases":[],"summary":"### Summary\nAn admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented\n`\/api\/<func>` RPC surface \u2014 e.g. `POST \/api\/set_user_permission` (or its legacy alias\n`\/api\/setUserPermission`) \u2014 updates the target's database row but never invalidates ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pyload-ng","publishedAt":"2026-10-09T17:09:07Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.5.0b3.dev98 <= 0.5.0b3.dev101"},{"id":"GHSA-fr26-jjhm-638c","title":"pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)","aliases":[],"summary":"### Summary\n\n`UnTar._safe_extractall` \u2014 the hardening added for GHSA-mvwx-582f-56r7 \u2014 validates member\n**names** and symlink\/hardlink **targets**, but never checks member **types**, and calls\n`tarfile.extractall` without a `filter=`. On Python < 3.14 the default extraction filter","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pyload-ng","publishedAt":"2026-10-09T17:08:58Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 0.5.0b3.dev101"},{"id":"GHSA-662p-52hx-cmh2","title":"Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest \u2192 RCE via a compromised mirror or MITM","aliases":["CVE-2026-107812"],"summary":"## Summary\nThe self-upgrade downloads the release binary and its checksum (`*.tar.gz` and `*.tar.gz.digest`)\nthrough the SAME endpoint (`version.GetUrl()`, which is `github_proxy` or, by default, the project's\n`cloud.nginxui.com` mirror), and verifies the binary ONLY by comparing","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-09T17:08:21Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260728114330-580585516dd8","vulnerableRange":">= 1.9.10-0.20250517140552-daee3ac7ade1 < 1.9.10-0.20260728114330-580585516dd8"},{"id":"GHSA-45gv-9wjv-xh7p","title":"Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)","aliases":["CVE-2026-107808"],"summary":"## Summary\n\nnginx-ui supports two second-factor methods \u2014 TOTP (OTP) and WebAuthn passkeys \u2014\nand reports an account as 2FA-enabled when **either** is configured. However, the\npassword login endpoint (`POST \/api\/login`) only enforces a second factor when a\n**TOTP secret** is prese","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-09T17:08:15Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260728074558-95cd21b70814","vulnerableRange":">= 1.9.10-0.20250517140552-daee3ac7ade1 < 1.9.10-0.20260728074558-95cd21b70814"},{"id":"GHSA-33rr-wq23-g6gg","title":"Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs","aliases":["CVE-2026-107809"],"summary":"## Summary\nNginx-UI v2.4.3 stores the API JWT in a browser cookie named `token` and the `AuthRequired` middleware accepts that cookie as an authentication source. Because management endpoints are protected by `AuthRequired` and do not enforce a universal CSRF token or Origin\/Refe","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-09T17:08:10Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260728074433-a3999bd78a3b","vulnerableRange":">= 1.9.10-0.20250517140552-daee3ac7ade1 < 1.9.10-0.20260728074433-a3999bd78a3b"},{"id":"GHSA-h246-wpgf-vmq5","title":"Nginx UI: Incomplete fix of CVE-2026-84315 - the api\/cluster router was not -  wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up","aliases":["CVE-2026-107813"],"summary":"## Summary\n\nIncomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session (OTP step-up) requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api\/cluster router, so cluster node management and cluster-wide nginx reload\/re","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-09T17:08:06Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260728074433-a3999bd78a3b","vulnerableRange":">= 1.9.10-0.20250517140552-daee3ac7ade1 < 1.9.10-0.20260728074433-a3999bd78a3b"},{"id":"GHSA-32gc-wf3m-78w9","title":"0xJacky\/nginx-ui \/api\/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser","aliases":["CVE-2026-107811"],"summary":"Summary\n0xJacky\/nginx-ui contains a high-severity trust-boundary failure between ordinary users and cluster node credentials. The source code shows that cluster node list and detail endpoints are reachable by ordinary authenticated users and return node objects containing the tok","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-09T17:07:23Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260728091109-0ecbd106c37b","vulnerableRange":">= 1.9.10-0.20250517140552-daee3ac7ade1 < 1.9.10-0.20260728091109-0ecbd106c37b"},{"id":"GHSA-pvgv-gcp7-v38g","title":"Nginx UI: Node Secret Credential Exposure via URL Query Parameter","aliases":["CVE-2026-107807"],"summary":"## 1. Vulnerability Summary\n\nnginx-ui's `Node.Secret` is a master credential that bypasses all JWT\/password authentication for the entire API. The application accepts this credential via a **URL query parameter** (`?node_secret=`), causing it to be recorded in plaintext in HTTP a","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-09T17:07:09Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260728074433-a3999bd78a3b","vulnerableRange":">= 1.9.10-0.20250517140552-daee3ac7ade1 < 1.9.10-0.20260728074433-a3999bd78a3b"},{"id":"GHSA-p8v3-89rh-jxc7","title":"Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied","aliases":["CVE-2026-107810"],"summary":"### Summary\nAn authenticated user who can create and restore a backup can craft a valid backup archive that causes the restore staging process to write attacker-controlled files into the live Nginx configuration path even when both `restore_nginx` and `restore_nginx_ui` are set t","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/0xJacky\/Nginx-UI","publishedAt":"2026-10-09T17:07:05Z","exploitedKev":false,"fixedVersion":"1.9.10-0.20260728074146-a467ed652591","vulnerableRange":">= 1.9.10-0.20250517140552-daee3ac7ade1 < 1.9.10-0.20260728074146-a467ed652591"},{"id":"GHSA-r44w-v6gf-x3p6","title":"pyLoad has an authentication bypass in API key validation (check_apikey cache)","aliases":[],"summary":"## Summary\n\nThe API-key cache in `check_apikey()` allows an attacker to authenticate with a **forged API key** as long as the legitimate key for the same `key_id` has been used recently.\n\nOn a cache hit, the API key **secret is never verified**, resulting in a complete authentica","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pyload-ng","publishedAt":"2026-10-09T16:43:55Z","exploitedKev":false,"fixedVersion":"0.5.0b3.dev101","vulnerableRange":"< 0.5.0b3.dev101"},{"id":"GHSA-j6cw-g6p4-7hch","title":"Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL","aliases":["CVE-2026-55797"],"summary":"### Impact\n\nArgo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH `ProxyCommand`. A host that contains shell metacharacters breaks out of that command and runs in the re","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/argoproj\/argo-cd\/v2","publishedAt":"2026-10-09T16:37:24Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 2.11.0 <= 2.14.21"},{"id":"GHSA-pfvf-fwfp-25mp","title":"Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy","aliases":["CVE-2026-107728"],"summary":"### Summary\n\n`PermissionExtension.resolve()` evaluates the return value of `has_permission()` for truthiness on the synchronous path. `supports_sync` only classifies a permission as asynchronous when `has_permission` is declared with `async def` (via `inspect.iscoroutinefunction`","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"strawberry-graphql","publishedAt":"2026-10-09T14:07:16Z","exploitedKev":false,"fixedVersion":"0.326.1","vulnerableRange":">= 0.217.0 <= 0.326.0"},{"id":"GHSA-8wpc-h4q6-8fxv","title":"fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set","aliases":["CVE-2026-107720"],"summary":"### Summary\n\n`createVerifier` in fast-jwt \u2264 6.3.0 skips signature verification entirely when the `key` option is a falsy synchronous value (`''` or `null`) **and** the `algorithms` option is set to a non-empty allowlist. An attacker who can present a JWT to the application \u2014 rega","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fast-jwt","publishedAt":"2026-10-08T22:02:12Z","exploitedKev":false,"fixedVersion":"6.3.1","vulnerableRange":"<= 6.3.0"},{"id":"GHSA-ww5h-9m49-7xx4","title":"fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA\u2192HS256 algorithm confusion","aliases":["CVE-2026-107722"],"summary":"### Summary\n\nThe fix for CVE-2026-34950 (CVSS 9.1, released in v6.2.0) is **incomplete**. It adds `key.trim()` to the PEM-detection path in `src\/crypto.js`, but `String.prototype.trim()` only strips characters classified as whitespace by the ECMAScript specification. The subseque","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"fast-jwt","publishedAt":"2026-10-08T22:02:07Z","exploitedKev":false,"fixedVersion":"6.3.0","vulnerableRange":">= 6.2.0 <= 6.2.4"},{"id":"GHSA-5hjw-83fp-phq9","title":"fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array","aliases":["CVE-2026-107723"],"summary":"### Summary\n `fast-jwt`'s `createVerifier` silently skips **all** configured claim validators (`exp`, `nbf`, `iss`, `aud`, `sub`, `jti`, `nonce`) when a validly-signed JWT carries a JSON array as its payload instead of an object. The verifier reports success while having enforced","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fast-jwt","publishedAt":"2026-10-08T22:01:58Z","exploitedKev":false,"fixedVersion":"6.3.0","vulnerableRange":"<= 6.2.4"},{"id":"GHSA-g3jj-5cmm-3hxx","title":"fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery","aliases":["CVE-2026-107724"],"summary":"### Summary\n\n`fast-jwt` 6.2.4 silently classifies raw serialized public JWK JSON\nas an HMAC secret.\n\nIf an application supplies public JWK JSON text as the verifier key and\nHS256 is explicitly allowed or automatically inferred, an attacker who\nknows the same public JSON text can ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fast-jwt","publishedAt":"2026-10-08T22:01:53Z","exploitedKev":false,"fixedVersion":"6.3.0","vulnerableRange":"= 6.2.4"},{"id":"GHSA-6wjp-v33h-5cvq","title":"PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure","aliases":["CVE-2026-61426"],"summary":"## Summary\n\nThe AgentOS server in the `praisonai` TypeScript\/npm package ships an insecure default: it binds `0.0.0.0`, sets no API key, and uses CORS `*` with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart (`new","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"praisonai","publishedAt":"2026-10-08T22:01:29Z","exploitedKev":false,"fixedVersion":"1.7.3","vulnerableRange":"< 1.7.3"},{"id":"GHSA-c78w-2q4r-68r7","title":"PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass","aliases":["CVE-2026-61442"],"summary":"# Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass\n\n## Summary\n\n`praisonai-platform` lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner\/ad","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonai-platform","publishedAt":"2026-10-08T22:01:11Z","exploitedKev":false,"fixedVersion":"0.1.9","vulnerableRange":"<= 0.1.8"},{"id":"GHSA-cv3g-hj65-pcfh","title":"PraisonAI: Shell command allowlist bypass via find -exec built-in action","aliases":["CVE-2026-61434"],"summary":"### Summary\n\nThe shell command execution hardening introduced in PraisonAI npm 1.7.2 \/ Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj (utility-tools shell chaining) and GHSA-vjv9-7m7j-h833 (SandboxExecutor chaining) can be bypassed via `find`'s built-in `-exec` action.\n\nThe fix blocks ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonai","publishedAt":"2026-10-08T22:00:55Z","exploitedKev":false,"fixedVersion":"4.6.78","vulnerableRange":"<= 4.6.77"},{"id":"GHSA-9mp3-24cc-77mg","title":"PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls","aliases":["CVE-2026-61445"],"summary":"### Summary\nThe `AICoder` UI component exposes `write_to_file` and `execute_command` tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem (including `\/root\/.ssh\/authorized_keys`, `\/etc","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonai","publishedAt":"2026-10-08T22:00:40Z","exploitedKev":false,"fixedVersion":"4.6.78","vulnerableRange":"<= 4.6.77"},{"id":"GHSA-hc5v-gxvj-58wh","title":"PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface","aliases":["CVE-2026-61427"],"summary":"## Summary\n\nPraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults `--api-key` to `None`, so `praisonai mcp serve --transport http-stream` exposes the full MCP surface unauthenticated. A request with no `Authorization` (and ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonai","publishedAt":"2026-10-08T21:58:42Z","exploitedKev":false,"fixedVersion":"4.6.78","vulnerableRange":"<= 4.6.77"},{"id":"GHSA-5r6c-gj4g-r697","title":"PraisonAI: SecurityPolicy command\/path\/import restrictions are completely unenforced by the default SubprocessSandbox backend","aliases":["CVE-2026-60085"],"summary":"Summary\nSecurityPolicy in praisonaiagents\/sandbox\/config.py is a documented configuration data class with fields for allow_subprocess, allowed_paths, blocked_paths, allowed_commands, blocked_commands, allowed_imports, and blocked_imports. Its strict() classmethod is explicitly de","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonai","publishedAt":"2026-10-08T21:58:11Z","exploitedKev":false,"fixedVersion":"4.6.78","vulnerableRange":"<= 4.6.77"},{"id":"GHSA-4w49-gwv8-fpjg","title":"PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF","aliases":["CVE-2026-60091"],"summary":"## Summary\n\nPraisonAI's Async Jobs API enables its API-key middleware **only when `PRAISONAI_JOBS_API_KEY` is set**, so by default every endpoint is unauthenticated. An unauthenticated `POST \/api\/v1\/runs` accepts an attacker-controlled `webhook_url`; on job completion the server ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonai","publishedAt":"2026-10-08T21:57:57Z","exploitedKev":false,"fixedVersion":"4.6.78","vulnerableRange":"<= 4.6.77"},{"id":"GHSA-6fqq-452j-qhrp","title":"Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early","aliases":["CVE-2026-107286"],"summary":"> This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David.\n\n### Summary\n\nApplications that wrap a model with `ConcurrencyLimitedModel` or `limit_model_concurrency` can permanently lose shared concurrency capacity when a streamed request releases its slot from ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pydantic-ai","publishedAt":"2026-10-08T19:42:55Z","exploitedKev":false,"fixedVersion":"2.53.0","vulnerableRange":">= 2.10.0 < 2.53.0"},{"id":"GHSA-r3rv-jm3r-62q2","title":"MariaDB Connector\/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES","aliases":["CVE-2026-107385"],"summary":"### Description\nWhen escaping string and binary parameters for the text protocol, the connector always escaped the quote character with a backslash, without ever consulting the session's NO_BACKSLASH_ESCAPES SQL mode. The server status flag was declared (STATUS_NO_BACKSLASH_ESCAP","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"mariadb","publishedAt":"2026-10-08T19:42:28Z","exploitedKev":false,"fixedVersion":"3.2.5","vulnerableRange":"< 3.2.5"},{"id":"GHSA-v6pj-gxxw-phfw","title":"MariaDB Connector\/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)","aliases":["CVE-2026-107384"],"summary":"### Description\nWith the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"mariadb","publishedAt":"2026-10-08T19:42:23Z","exploitedKev":false,"fixedVersion":"3.2.5","vulnerableRange":">= 3.2.0 < 3.2.5"},{"id":"GHSA-48qf-xh34-q73r","title":"MariaDB Connector\/Node.js exposes uninitialized process memory through malformed GeoJSON parameters","aliases":["CVE-2026-107383"],"summary":"### Description\nWhen encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"mariadb","publishedAt":"2026-10-08T19:42:11Z","exploitedKev":false,"fixedVersion":"3.2.5","vulnerableRange":"< 3.2.5"},{"id":"GHSA-c3jg-qh8m-j3h2","title":"CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>","aliases":["CVE-2026-107378"],"summary":"## Summary\n\nRendering an untrusted SVG whose `<path d=\"...\">` contains many segments is O(n\u00b2) CPU. A single `<path>` under 1 MiB burns tens of seconds. Two independent O(n\u00b2) sites in `cairosvg\/path.py`:\n\n1. **Tokenizer** \u2014 the path-data parser consumes the `d` string with a `whil","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"cairosvg","publishedAt":"2026-10-08T19:41:22Z","exploitedKev":false,"fixedVersion":"2.9.1","vulnerableRange":"<= 2.9.0"},{"id":"GHSA-79fv-7hq9-w7xg","title":"PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source","aliases":["CVE-2026-61433"],"summary":"# API deploy code generator embeds unescaped YAML fields into Python source\n\n## Summary\n\nPraisonAI's API deployment generator copies `deploy.api.host` from `agents.yaml` directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set tha","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonai","publishedAt":"2026-10-08T19:36:29Z","exploitedKev":false,"fixedVersion":"4.6.78","vulnerableRange":"<= 4.6.77"},{"id":"GHSA-2gpf-2492-q9jh","title":"PraisonAI: Call API localhost-only authentication bypass via spoofed Host header","aliases":["CVE-2026-61435"],"summary":"# Call API localhost-only authentication bypass via spoofed Host header\n\n## Summary\n\nPraisonAI's patched `PRAISONAI_CALL_AUTH=disabled` safeguard for the n8n\/call agent invocation API can be bypassed with a spoofed `Host: 127.0.0.1` header, allowing an unauthenticated network cal","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonai","publishedAt":"2026-10-08T19:36:26Z","exploitedKev":false,"fixedVersion":"4.6.78","vulnerableRange":"<= 4.6.77"},{"id":"GHSA-77xj-x4rm-935c","title":"datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory","aliases":["CVE-2026-107377"],"summary":"## Summary\n\nWhen processing an attacker-controlled Protobuf schema, vulnerable versions of\n`datamodel-code-generator` could write a generated weak-import stub outside the\nintended `__weak_imports__` temporary directory. Absolute import paths and relative\npaths containing `..` cou","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"datamodel-code-generator","publishedAt":"2026-10-08T17:58:01Z","exploitedKev":false,"fixedVersion":"0.81.0","vulnerableRange":">= 0.59.0 <= 0.80.0"},{"id":"GHSA-8r5x-fm3f-whwj","title":"Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)","aliases":["CVE-2026-106446"],"summary":"## Summary\n\n`Handlebars.compile()` and `Handlebars.precompile()` accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on `PathExpression`, `NumberLiteral` and `BooleanLiteral` nodes, and the compiler still wr","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"handlebars","publishedAt":"2026-10-08T17:52:32Z","exploitedKev":false,"fixedVersion":"4.7.10","vulnerableRange":">= 4.0.0 <= 4.7.9"},{"id":"GHSA-p8wg-vrv2-v86f","title":"Handlebars: JavaScript Injection via Own Property Check Bypass","aliases":["CVE-2026-106445"],"summary":"## Summary\n\nHandlebars can expose the `Function` constructor despite its prototype-access deny list. When a template reaches `Function.prototype`, its own `constructor` property is returned before the deny list is checked. An attacker who can render a controlled template with `al","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"handlebars","publishedAt":"2026-10-08T17:52:26Z","exploitedKev":false,"fixedVersion":"4.7.10","vulnerableRange":">= 3.0.0 <= 4.7.9"},{"id":"GHSA-mx22-3794-2vpv","title":"Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic","aliases":["CVE-2026-107211"],"summary":"### Summary\n\nextractPivotTableFields builds `order := pc.getPivotCacheFieldsName()` from xl\/pivotCache\/pivotCacheDefinitionN.xml's <cacheFields> list, then indexes it with values taken from a *separately parsed* xl\/pivotTables\/pivotTableN.xml part with zero cross-validation: `ord","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/xuri\/excelize\/v2","publishedAt":"2026-10-08T17:52:17Z","exploitedKev":false,"fixedVersion":"2.11.1-0.20261003002531-6258dcebc4e2","vulnerableRange":">= 2.8.1 < 2.11.1-0.20261003002531-6258dcebc4e2"},{"id":"GHSA-6gcq-wc29-5xf2","title":"Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)","aliases":["CVE-2026-107826"],"summary":"### Summary\n\nThe JSON body processor (`internal\/bodyprocessors\/json.go`) can be made to\ncrash the whole process with an unrecoverable `fatal error: stack overflow`,\nusing a request body that is well under the recommended `SecRequestBodyLimit`\nand the default `SecArgumentsLimit`.\n","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/corazawaf\/coraza\/v3","publishedAt":"2026-10-08T17:45:46Z","exploitedKev":false,"fixedVersion":"3.8.1","vulnerableRange":">= 3.0.0 < 3.8.1"},{"id":"GHSA-r223-96jv-q533","title":"JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort","aliases":["CVE-2026-107375"],"summary":"# SQL Injection in the `sort` Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applications\n\n- **Product**: jhipster\/generator-jhipster (npm package `generator-jhipster`)\n- **Affected versions**: v7.0.0 through v9.2.0 \n- **Component**: generated reactive-application cod","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"generator-jhipster","publishedAt":"2026-10-08T17:40:37Z","exploitedKev":false,"fixedVersion":"9.4.0","vulnerableRange":">= 7.0.0 < 9.4.0"},{"id":"GHSA-9ffp-22j7-56r2","title":"JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob","aliases":["CVE-2026-107303"],"summary":"## Summary\nApplications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. The shared generated `openFile` helper creates an object URL from the Blob and opens it in ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"generator-jhipster","publishedAt":"2026-10-08T17:40:29Z","exploitedKev":false,"fixedVersion":"9.4.0","vulnerableRange":"< 9.4.0"},{"id":"GHSA-8f34-f56x-9xph","title":"msgpack5: Truncated map32 headers throw an unexpected error","aliases":["CVE-2026-107302"],"summary":"### Impact\n\nA truncated `map32` header causes an out-of-bounds buffer read and throws `RangeError` instead of `IncompleteBufferError`. Applications that rely on `IncompleteBufferError` to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjace","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"msgpack5","publishedAt":"2026-10-08T17:40:10Z","exploitedKev":false,"fixedVersion":"6.1.0","vulnerableRange":">= 4.1.0 < 6.1.0"},{"id":"GHSA-5x5g-h9x8-2fh9","title":"msgpack5: Many buffered values can exhaust the streaming decoder stack","aliases":["CVE-2026-107300"],"summary":"### Impact\n\nThe streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.\n\n### Patches\n\nThe streaming decoder","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"msgpack5","publishedAt":"2026-10-08T17:40:06Z","exploitedKev":false,"fixedVersion":"6.1.0","vulnerableRange":"< 6.1.0"},{"id":"GHSA-h4xc-3qfq-jf93","title":"Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint","aliases":["CVE-2026-107295"],"summary":"### Summary\n\nThe Pydantic AI development web chat UI (`Agent.to_web()`, `clai web`) did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the ser","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pydantic-ai","publishedAt":"2026-10-08T17:16:36Z","exploitedKev":false,"fixedVersion":"1.107.4","vulnerableRange":">= 1.34.0 < 1.107.4"},{"id":"GHSA-jw42-f3rr-4cc3","title":"Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days","aliases":["CVE-2026-107212"],"summary":"### Summary\n\nA worksheet whose `<row r=\"...\">` number is far past Excel's 1,048,576-row limit makes `File.GetRows` and the `Rows` iterator loop once for every missing row. The row limit is checked in `Rows.Next`, but not in `Rows.Columns`, which also reads `<row>` elements. A 1.5","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/xuri\/excelize\/v2","publishedAt":"2026-10-08T16:50:13Z","exploitedKev":false,"fixedVersion":"2.11.1-0.20260930021559-01a9ff32fb3c","vulnerableRange":">= 2.1.0 < 2.11.1-0.20260930021559-01a9ff32fb3c"},{"id":"GHSA-r7x5-4969-99p7","title":"Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element","aliases":["CVE-2026-107213"],"summary":"### Summary\n\nGetSlicers guards only `if ws.ExtLst == nil { return }` (slicer.go:816-818) and then immediately dereferences `ws.Drawing.RID` with no nil check on ws.Drawing itself. `Drawing` and `ExtLst` are two independently optional child elements of <worksheet> in xl\/worksheets","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/xuri\/excelize\/v2","publishedAt":"2026-10-08T16:50:08Z","exploitedKev":false,"fixedVersion":"2.11.1-0.20260929015830-8ffeb07ec9a3","vulnerableRange":">= 2.9.0 < 2.11.1-0.20260929015830-8ffeb07ec9a3"},{"id":"GHSA-c44f-37qr-gw3f","title":"PraisonAI: SkillTools Executes Scripts Without Path Containment Validation","aliases":["CVE-2026-61443"],"summary":"### Summary\n`SkillTools.run_skill_script()` accepts a `script_path` parameter and executes it via `subprocess.run()` without any path containment validation. While `FileTools` has `_validate_path()` with traversal detection, `SkillTools` performs none. An LLM-directed call can ex","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-10-08T16:49:23Z","exploitedKev":false,"fixedVersion":"1.6.78","vulnerableRange":"<= 1.6.77"},{"id":"GHSA-4gfv-wg42-7jw5","title":"PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow","aliases":["CVE-2026-61437"],"summary":"### Summary\nAn unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling `tools.py` to execute arbitrary Python code when the workflow is executed.\n\n### Details\nThe vulnerability is located in the workflow structured output resol","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-10-08T16:48:57Z","exploitedKev":false,"fixedVersion":"1.6.78","vulnerableRange":"<= 1.6.77"},{"id":"GHSA-m6wp-h223-4c8g","title":"PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification","aliases":["CVE-2026-61446"],"summary":"### Summary\nThe plugin manager loads and executes arbitrary `.py` files from `.praisonai\/plugins\/` directories (both project-level and user home) via `importlib.util.spec_from_file_location()` + `exec_module()` with zero code signing, integrity verification, or sandboxing. Any at","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-10-08T16:44:04Z","exploitedKev":false,"fixedVersion":"1.6.78","vulnerableRange":"<= 1.6.77"},{"id":"GHSA-2xv2-w8cq-5gxw","title":"PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets","aliases":["CVE-2026-61447"],"summary":"### Summary\n`CodeAgent._execute_python()` executes LLM-generated Python code in a subprocess with the complete parent-process environment (`os.environ.copy()`), zero AST validation, zero import restrictions, and no sandbox enforcement \u2014 even when `CodeConfig(sandbox=True)` is exp","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-10-08T16:44:01Z","exploitedKev":false,"fixedVersion":"1.6.78","vulnerableRange":"<= 1.6.77"},{"id":"GHSA-qg25-6gc4-48mg","title":"PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure","aliases":["CVE-2026-61430"],"summary":"## Summary\n\nPraisonAI's `web_crawl` agent tool performs a server-side HTTP fetch of an agent\/attacker-influenced URL. SSRF is meant to be prevented by `_is_safe_crawl_url()`, which resolves the hostname and rejects private\/loopback\/link-local IPs **at validation time**. The valid","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-10-08T16:36:50Z","exploitedKev":false,"fixedVersion":"1.6.78","vulnerableRange":"<= 1.6.77"},{"id":"GHSA-2j4c-ffch-9f23","title":"Excelize Decrypt: unrecoverable panics on malformed OLE\/CFB encrypted workbooks","aliases":["CVE-2026-107214"],"summary":"### Summary\n\nAny file whose first 8 bytes are the OLE compound-file signature (`D0 CF 11 E0 A1 B1 1A E1`) is routed by `OpenFile`\/`OpenReader`\/`OpenBytes` \u2192 `openReaderAt` \u2192 `Decrypt`. The version dispatch only guarantees `len(EncryptionInfo) >= 4` before handing attacker-control","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/xuri\/excelize\/v2","publishedAt":"2026-10-08T16:31:32Z","exploitedKev":false,"fixedVersion":"2.11.1-0.20260915055537-22f76f9acb94","vulnerableRange":">= 2.3.1 < 2.11.1-0.20260915055537-22f76f9acb94"},{"id":"GHSA-x2q3-8cjh-766f","title":"Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic \/ OOM DoS","aliases":["CVE-2026-107215"],"summary":"### Summary\n\n`extractPart` allocates directly from the mscfb directory-entry size with no clamping (`crypt.go:198`, same missing bound at `crypt.go:204`):\n\n```go\nbuf := make([]byte, entry.Size)\n```\n\n`entry.Size` is the raw `streamSize` field from the attacker-controlled CFB direc","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/xuri\/excelize\/v2","publishedAt":"2026-10-08T16:31:26Z","exploitedKev":false,"fixedVersion":"2.11.1-0.20260912113515-5f636f9dcde5","vulnerableRange":">= 2.3.1 < 2.11.1-0.20260912113515-5f636f9dcde5"},{"id":"GHSA-wp2g-vpjj-g53r","title":"Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow","aliases":["CVE-2026-107216"],"summary":"### Summary\n\n`ANCHORARRAY` (calc.go:15137 on current master) evaluates each cell of the referenced spill range by calling the **exported** `CalcCellValue`, which unconditionally constructs a fresh `calcContext` \u2014 fresh entry marker, fresh iterations map, full `MaxCalcIterations` ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/xuri\/excelize\/v2","publishedAt":"2026-10-08T16:31:21Z","exploitedKev":false,"fixedVersion":"2.11.1-0.20260911060113-ea12859e43c6","vulnerableRange":">= 2.8.1 < 2.11.1-0.20260911060113-ea12859e43c6"},{"id":"GHSA-fj8f-m44g-c479","title":"PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats","aliases":["CVE-2026-61439"],"summary":"### Summary\nInjection Defense is a purpose-built prompt injection defense layer. It scans LLM inputs through six detection categories: instruction overrides, authority claims, boundary manipulation, obfuscation, financial manipulation, and self-harm instructions.\n\nThe defense is ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PraisonAI","publishedAt":"2026-10-07T20:43:58Z","exploitedKev":false,"fixedVersion":"4.6.78","vulnerableRange":"<= 4.6.77"},{"id":"GHSA-788w-68h3-cvxp","title":"Ghost: Remote Code Execution via Bookmark Card Images","aliases":["CVE-2026-105642"],"summary":"### Impact\n\nAn image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server.\n\n### V","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ghost","publishedAt":"2026-10-07T20:43:08Z","exploitedKev":false,"fixedVersion":"6.67.0","vulnerableRange":">= 6.56.0 < 6.67.0"},{"id":"GHSA-69qc-f5m6-889c","title":"Ghost: Stored XSS via Embed Card Previews","aliases":["CVE-2026-105643"],"summary":"### Impact\n\nEmbed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, possibly resulting in compromise of tha","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ghost","publishedAt":"2026-10-07T20:43:05Z","exploitedKev":false,"fixedVersion":"6.67.0","vulnerableRange":">= 6.34.0 < 6.67.0"},{"id":"GHSA-x3q2-h9hx-4r4j","title":"Docling has arbitrary file read\/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine","aliases":["CVE-2026-105744"],"summary":"### Summary\n\nWhen the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (`LatexBackendOptions(tikz_engine=\"tectonic\")`), the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitive","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"docling","publishedAt":"2026-10-07T20:42:05Z","exploitedKev":false,"fixedVersion":"2.132.0","vulnerableRange":">= 2.94.0 < 2.132.0"},{"id":"GHSA-w794-rj3p-xv45","title":"Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration","aliases":["CVE-2026-105697"],"summary":"### Summary\n\nBefore **Langflow 1.10.3**, the MCP stdio transport launched whatever `command` \/ `args` a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in `bash -c \"exec {command} ...\"`. Any user able to reach the MCP server settings (\"Setti","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langflow","publishedAt":"2026-10-07T20:36:35Z","exploitedKev":false,"fixedVersion":"1.10.3","vulnerableRange":">= 1.1.2 < 1.10.3"},{"id":"GHSA-8575-cr6v-7jh4","title":"Ghost: Stored XSS via SVG Uploads Bypassing Sanitization","aliases":["CVE-2026-105649"],"summary":"### Impact\n\nSVG media thumbnails, and SVG images uploaded with a non-SVG file extension, were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessi","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ghost","publishedAt":"2026-10-07T20:35:22Z","exploitedKev":false,"fixedVersion":"6.65.0","vulnerableRange":">= 4.22.0 < 6.65.0"},{"id":"GHSA-4hmc-cfm3-w43c","title":"Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers","aliases":["CVE-2026-105699"],"summary":"### Summary\nLangflow's project-scoped MCP transport authenticates the caller for the `project_id` in the connection URL, but the subsequent `resources\/read` operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scope","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langflow","publishedAt":"2026-10-07T20:35:12Z","exploitedKev":false,"fixedVersion":"1.9.1","vulnerableRange":">= 1.6.8 <= 1.9.0"},{"id":"GHSA-cjq9-62q9-8jv4","title":"Next.js has Server-Side Request Forgery in Image Optimization","aliases":["CVE-2026-94483"],"summary":"## Impact\n\nAn attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. \n\n## Workaround\n\nAudit allow-listed remote URLs in `images.remotePatterns` (see https:\/\/nextjs.org\/docs\/app\/getting-started\/images#r","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"next","publishedAt":"2026-10-07T20:30:55Z","exploitedKev":false,"fixedVersion":"16.3.8","vulnerableRange":">= 16.0.0 < 16.3.8"},{"id":"GHSA-pj7x-6wpf-pgvp","title":"Payload: SQL injection in SQLite\/Postgres","aliases":["CVE-2026-105856"],"summary":"### Impact\n\nAn attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres.\n\n#### You are affected if:\n\n- You use `@payloadcms\/db-sqlite`","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@payloadcms\/db-sqlite","publishedAt":"2026-10-07T20:30:04Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":">= 3.0.0 < 3.90.0"},{"id":"GHSA-97rh-rhh2-7vjv","title":"Payload: Remote Code Execution through first-register","aliases":["CVE-2026-105858"],"summary":"### Impact\nA crafted request to the public first-register operation can be used to perform a RCE exploit.\n\n**You are affected if:**\n\n- You use local auth strategy and your application remains without an initial user created\n\n## Patches\n\nIn the patched version data submission to c","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-07T20:29:58Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":"< 3.90.0"},{"id":"GHSA-p96c-xwx8-3cqj","title":"Payload has a tenant authorization bypass in Multi-Tenant Plugin","aliases":["CVE-2026-105860"],"summary":"## Impact\n\nWhen using the default tenant array field access, an authenticated user could assign themselves to other tenants.\n\n**You are affected if:**\n\n- You are using `@payloadcms\/plugin-multi-tenant`\n\nIf you configure the tenants arrayFieldAccess.create\/update functions, a secu","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@payloadcms\/plugin-multi-tenant","publishedAt":"2026-10-07T20:29:53Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":"< 3.90.0"},{"id":"GHSA-pj5h-5q6c-3pfx","title":"Payload external upload trust validation issue","aliases":["CVE-2026-105861"],"summary":"## Impact\n\nUnder certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient.\n\n**You are affected if:","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-07T20:29:41Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":">= 3.0.0 < 3.90.0"},{"id":"GHSA-2pwp-2369-8fg3","title":"Payload: Bypassed sanitization of user uploaded SVGs","aliases":["CVE-2026-105862"],"summary":"## Impact\n\nA malicious SVG file upload could bypass sanitization, be stored, and execute attacker-controlled JavaScript (XSS) after a user downloads it and opens it.\n\n**You are affected if:**\n\n- You have a collection configured to upload and allow SVG files which can then be down","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-07T20:29:36Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":"< 3.90.0"},{"id":"GHSA-p223-2wr2-j562","title":"Payload: Incomplete validation during the upload file lifecycle","aliases":["CVE-2026-105865"],"summary":"## Impact\nUnder certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption.\n\nYou are affected if:\n- You use Payload upload collections with local fi","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-07T20:29:09Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":"< 3.90.0"},{"id":"GHSA-7vg8-29qx-jgj8","title":"Payload: Client uploads could overwrite S3 objects","aliases":["CVE-2026-105867"],"summary":"### Impact\nAn authenticated user could overwrite an existing S3 object belonging to another upload collection, bypassing that collection\u2019s access controls and prior file validation.\n\nYou are affected if ALL of these are true:\n- Client uploads are enabled for multiple collections ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@payloadcms\/storage-s3","publishedAt":"2026-10-07T20:28:59Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":"< 3.90.0"},{"id":"GHSA-9qpg-3cf8-w33x","title":"Payload: Uploaded XML files could execute same-origin JavaScript","aliases":["CVE-2026-105868"],"summary":"### Impact\nUnder certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file.\n\nYou are affected if:\n- You accept XML uploads (accepted by default).\n\n### Patches\nUsers should upgrade P","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-07T20:28:53Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":"< 3.90.0"},{"id":"GHSA-r488-j9vj-wx3q","title":"Payload Form Builder has an RCE issue","aliases":["CVE-2026-105857"],"summary":"## Impact\n\nA vulnerability in `@payloadcms\/plugin-form-builder` in versions < 3.90.0 allow submissions which could be crafted to execute remote code on the server.\n\n**You are affected if:**\n\n- You are using `@payloadcms\/plugin-form-builder`\n\n## Patches\n\nUsers should upgrade Paylo","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@payloadcms\/plugin-form-builder","publishedAt":"2026-10-07T20:28:33Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":"< 3.90.0"},{"id":"GHSA-f7hx-52q9-hcrf","title":"Payload: Unauthorized update to collection documents","aliases":["CVE-2026-105859"],"summary":"## Impact\n\nAn attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control.\n\n**You are affected if:**\n\n- You are configuring `orderable: true` with any collection or join field.\n\n#","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-07T20:28:27Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":"< 3.90.0"},{"id":"GHSA-66wr-7vmr-p5jq","title":"Payload authentication token field handling issue","aliases":["CVE-2026-105863"],"summary":"### Impact\n\nUnder certain field configurations, Payload could include unintended values in the authentication token issued at login.\n\nYou are affected if:\n\n- You use an affected Payload version and have configured a custom field option that maps a field to a reserved authenticati","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-07T20:28:18Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":">= 3.0.0 < 3.90.0"},{"id":"GHSA-v3xr-g6p2-fvgv","title":"Ghost: Stored XSS via oEmbed Photo Responses","aliases":["CVE-2026-105650"],"summary":"### Impact\n\nEmbedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin s","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ghost","publishedAt":"2026-10-07T20:27:46Z","exploitedKev":false,"fixedVersion":"6.64.0","vulnerableRange":">= 2.5.0 < 6.64.0"},{"id":"GHSA-347q-26qq-h2p6","title":"Ghost: Stored XSS via Bookmark Card Images","aliases":["CVE-2026-105651"],"summary":"### Impact\n\nWhen creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of oth","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ghost","publishedAt":"2026-10-07T20:27:41Z","exploitedKev":false,"fixedVersion":"6.64.0","vulnerableRange":">= 5.94.0 < 6.64.0"},{"id":"GHSA-v6q3-xqxm-6f5v","title":"Ghost: Invite Token Disclosure in Ghost Admin API","aliases":["CVE-2026-105675"],"summary":"### Impact\n\nStaff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite.\n\n#","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ghost","publishedAt":"2026-10-07T20:26:19Z","exploitedKev":false,"fixedVersion":"6.64.0","vulnerableRange":">= 4.39.0 < 6.64.0"},{"id":"GHSA-jj74-hc2q-xrvm","title":"Ghost: Remote Code Execution via Theme Translation Files","aliases":["CVE-2026-105677"],"summary":"### Impact\n\nA vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from v6.10.3 up to v6.64.0.\n\n### Patches\n\nv6","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ghost","publishedAt":"2026-10-07T20:26:08Z","exploitedKev":false,"fixedVersion":"6.64.0","vulnerableRange":">= 6.10.3 < 6.64.0"},{"id":"GHSA-gfjp-2p8f-94qv","title":"Ghost: Stored XSS via File Uploads on Local Storage","aliases":["CVE-2026-105679"],"summary":"### Impact\n\nGhost restricts the content type that uploaded files are served with, to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type deriv","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ghost","publishedAt":"2026-10-07T20:25:58Z","exploitedKev":false,"fixedVersion":"6.64.0","vulnerableRange":">= 6.22.1 < 6.64.0"},{"id":"GHSA-q38j-6vcm-2f5m","title":"Backstage: Improper validation of MkDocs plugin configuration in TechDocs","aliases":["CVE-2026-106455"],"summary":"### Impact\n\nAn authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-techdocs-node","publishedAt":"2026-10-07T20:25:19Z","exploitedKev":false,"fixedVersion":"1.14.7","vulnerableRange":">= 0.11.12 < 1.14.7"},{"id":"GHSA-g734-fhp4-7mfp","title":"Backstage: Improper input validation in Sentry scaffolder actions","aliases":["CVE-2026-106459"],"summary":"### Impact\n\nAn authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured tok","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-scaffolder-backend-module-sentry","publishedAt":"2026-10-07T20:25:01Z","exploitedKev":false,"fixedVersion":"0.3.8","vulnerableRange":">= 0.3.0 < 0.3.8"},{"id":"GHSA-5jjj-9xc3-rm56","title":"Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method","aliases":["CVE-2026-106440"],"summary":"## Summary\n\n`hydra-optuna-sweeper` accepted a configuration-controlled dotted path in\n`hydra.sweeper.custom_search_space`, resolved it with the lower-level\n`hydra.utils.get_method()` API, and later invoked the returned callable.\n\nHydra's object-lookup helpers intentionally trust ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"hydra-optuna-sweeper","publishedAt":"2026-10-07T20:24:02Z","exploitedKev":false,"fixedVersion":"1.3.0","vulnerableRange":">= 1.2.0 < 1.3.0"},{"id":"GHSA-mwj6-rfh8-7qf4","title":"Hydra: Mutable instantiate policy sets allow target blocklist bypass","aliases":["CVE-2026-106439"],"summary":"## Summary\n\nHydra's legacy `instantiate()` target blocklists and related execution-policy\ncollections are stored in mutable module-level state. Because `_locate()` can\nresolve attributes on imported objects, a configuration can resolve a mutation\nmethod such as `.discard()`, modi","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"hydra-core","publishedAt":"2026-10-07T20:23:57Z","exploitedKev":false,"fixedVersion":"1.3.7","vulnerableRange":">= 1.3.4 < 1.3.7"},{"id":"GHSA-c85p-xxjj-2r75","title":"Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r=\"0\" rows","aliases":["CVE-2026-107217"],"summary":"### Summary\n\n`ColumnNameToNumber` (lib.go:220-237) accumulates the bijective base-26 value of a column name in an int64 with only an upper-bound check (`col > MaxColumns`) applied after the loop and no overflow detection. A 14-letter column name whose true value is 3\u00b72\u2076\u2074 \u2014 e.g. *","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/xuri\/excelize\/v2","publishedAt":"2026-10-07T20:23:31Z","exploitedKev":false,"fixedVersion":"2.11.1-0.20260910071107-696050fbf14e","vulnerableRange":">= 2.0.0 < 2.11.1-0.20260910071107-696050fbf14e"},{"id":"GHSA-jrfj-fhj2-jjvm","title":"Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile","aliases":["CVE-2026-107219"],"summary":"Opening a file whose first eight bytes are the OLE magic number sends excelize down the decryption path whether or not the caller set a password, or supports encrypted workbooks at all. `openReaderAt` (excelize.go:198-215) branches on the header alone, and `agileDecrypt` calls `c","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/xuri\/excelize\/v2","publishedAt":"2026-10-07T20:23:22Z","exploitedKev":false,"fixedVersion":"2.11.1-0.20260906004932-2badfcd5841d","vulnerableRange":">= 2.3.1 < 2.11.1-0.20260906004932-2badfcd5841d"},{"id":"GHSA-fq3v-74gv-27gm","title":"Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process","aliases":["CVE-2026-107223"],"summary":"### Summary\n\nThe `max` attribute of a `<col>` element in `xl\/worksheets\/sheetN.xml` is read verbatim on open with no check against `MaxColumns`, and `flatCols()` then walks `Min..Max` doing a `deepcopy.Copy` and `append` per iteration. Executed: `max=\"300000\"`, only about 18x pas","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/xuri\/excelize\/v2","publishedAt":"2026-10-07T20:22:49Z","exploitedKev":false,"fixedVersion":"2.11.1-0.20260807015645-a54c578af309","vulnerableRange":">= 2.1.0 < 2.11.1-0.20260807015645-a54c578af309"},{"id":"GHSA-6g59-gm2v-qhvq","title":"PraisonAI: Crawl4AI\/Chromium backend is also affected by the `web_crawl` SSRF validation bypass","aliases":["CVE-2026-61429"],"summary":"## Summary\n\nThe DNS-rebinding \/ redirect SSRF bypass in PRAI-05 is **not limited to the httpx\/urllib backend**. When `crawl4ai` (headless Chromium via Playwright) is installed, `web_crawl` auto-selects `provider=crawl4ai`, and the headless browser re-resolves DNS and follows redi","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-10-07T20:22:17Z","exploitedKev":false,"fixedVersion":"1.6.78","vulnerableRange":"<= 1.6.77"},{"id":"GHSA-r543-q48m-4c9j","title":"WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE","aliases":["CVE-2026-106443"],"summary":"### Summary\n\nThis was found during a pentest, funded by the NLNnet foundation, conducted by Stefan Vink from Radically Open Security and the only High issue found. \n\nWeasyPrint passes fetched image bytes directly to Pillow's generic format dispatcher without restricting the input","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"WeasyPrint","publishedAt":"2026-10-07T18:05:49Z","exploitedKev":false,"fixedVersion":"70.0","vulnerableRange":"<= 69.0"},{"id":"GHSA-p279-5wcv-45vq","title":"Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution","aliases":["CVE-2026-104890"],"summary":"### Summary\n\nThe MediaBundle blocks dangerous upload extensions with a blacklist that was matched\ncase-sensitively, while the stored filename was lowercased afterwards. A file uploaded\nas `webshell.pHp` therefore bypassed the blacklist and was written to the web-accessible\nupload","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"kunstmaan\/media-bundle","publishedAt":"2026-10-07T18:05:38Z","exploitedKev":false,"fixedVersion":"7.3.2","vulnerableRange":"< 7.3.2"},{"id":"GHSA-pq68-rvw4-xp4r","title":"vm2 contains a sandbox escape vulnerability","aliases":["CVE-2026-93605"],"summary":"vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is co","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-07T18:05:00Z","exploitedKev":false,"fixedVersion":"3.12.1","vulnerableRange":"<= 3.12.0"},{"id":"GHSA-c3wx-c55w-pxjq","title":"Hydra logging configuration permits unsafe callable resolution","aliases":["CVE-2026-106441"],"summary":"## Summary\n\nHydra passed its Python logging configuration to `logging.config.dictConfig()`. Python's logging configurator can resolve and invoke importable classes and factories named by configuration, including handler `class` values and formatter, filter, handler, queue, and li","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"hydra-core","publishedAt":"2026-10-07T18:03:55Z","exploitedKev":false,"fixedVersion":"1.3.6","vulnerableRange":"< 1.3.6"},{"id":"GHSA-rqx7-p7vv-w7hr","title":"Hydra instantiate target blacklist bypasses permit code execution","aliases":["CVE-2026-106442"],"summary":"## Summary\n\nHydra's `instantiate()` API resolves and invokes Python callables named by the `_target_` field in configuration. The target blacklist introduced for CVE-2026-68508 was incomplete.\n\nRepresentative bypasses included execution wrappers such as `timeit.timeit`, executabl","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"hydra-core","publishedAt":"2026-10-07T18:03:49Z","exploitedKev":false,"fixedVersion":"1.3.6","vulnerableRange":">= 1.3.4 < 1.3.6"},{"id":"GHSA-jg6q-3qfh-r9f8","title":"mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control","aliases":["CVE-2026-104891"],"summary":"### Impact\n\nBoth packages wrap an `mppx` payment method so that a wallet meeting on-chain conditions is granted free access instead of being charged.\n\nThe free-access path reads the payer address from `credential.source` \u2014 a client-supplied DID in the payment credential \u2014 asks In","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@insumermodel\/mppx-condition-gate","publishedAt":"2026-10-07T18:03:42Z","exploitedKev":false,"fixedVersion":"3.0.0","vulnerableRange":"<= 2.0.3"},{"id":"GHSA-4488-j8vj-vqqv","title":"Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml","aliases":["CVE-2026-106510"],"summary":"### Impact\n\nAn authenticated user who can register catalog entities can provide a crafted `mkdocs.yml` causing arbitrary OS command execution on the TechDocs build host when the docs are built.\n\n### Patches\n\nPatched in `@backstage\/plugin-techdocs-node`, version `1.15.4`.\n\n### Wor","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-techdocs-node","publishedAt":"2026-10-07T18:03:22Z","exploitedKev":false,"fixedVersion":"1.15.4","vulnerableRange":"< 1.15.4"},{"id":"GHSA-qmw3-745m-w99g","title":"Backstage: Improper validation of TechDocs MkDocs configuration","aliases":["CVE-2026-106558"],"summary":"### Impact\n\nAn attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access.\n\n### Patches\n\nPatched in `@backstage\/plugin-techdocs-node` version `","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-techdocs-node","publishedAt":"2026-10-07T18:03:12Z","exploitedKev":false,"fixedVersion":"1.15.4","vulnerableRange":"< 1.15.4"},{"id":"GHSA-2cmg-v53w-8xfp","title":"Backstage: Improper repository path validation in a Scaffolder backend module","aliases":["CVE-2026-106560"],"summary":"### Impact\n\nAn authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process.\n\n### Patches\n\nPatched in `@backstage\/p","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-scaffolder-backend-module-confluence-to-markdown","publishedAt":"2026-10-07T18:02:59Z","exploitedKev":false,"fixedVersion":"0.3.25","vulnerableRange":"< 0.3.25"},{"id":"GHSA-g8rx-f7m5-7794","title":"Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions","aliases":["CVE-2026-106486"],"summary":"### Impact\n\nAn authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-scaffolder-backend-module-bitbucket-cloud","publishedAt":"2026-10-07T18:01:26Z","exploitedKev":false,"fixedVersion":"0.3.10","vulnerableRange":"< 0.3.10"},{"id":"GHSA-826h-28h9-65hg","title":"Backstage: Improper authentication in the OIDC provider","aliases":["CVE-2026-106488"],"summary":"### Impact\n\nDeployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct avail","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-auth-backend-module-oidc-provider","publishedAt":"2026-10-07T18:01:02Z","exploitedKev":false,"fixedVersion":"0.4.20","vulnerableRange":"< 0.4.20"},{"id":"GHSA-cq7v-rfgc-5c7v","title":"Backstage: Improper preservation of access restrictions during service credential delegation","aliases":["CVE-2026-106492"],"summary":"### Impact\n\nAn external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including w","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/backend-defaults","publishedAt":"2026-10-07T17:59:43Z","exploitedKev":false,"fixedVersion":"0.17.8","vulnerableRange":"< 0.17.8"},{"id":"GHSA-qgvj-qcf8-xq73","title":"Backstage: Improper URL validation in catalog entity placeholder resolution","aliases":["CVE-2026-106498"],"summary":"### Impact\n\nAn authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user.\n\n### Patch","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-catalog-backend","publishedAt":"2026-10-07T17:59:24Z","exploitedKev":false,"fixedVersion":"3.9.1","vulnerableRange":"< 3.9.1"},{"id":"GHSA-g2v8-7jhw-pp8p","title":"Backstage: Sensitive information exposure in Scaffolder","aliases":["CVE-2026-106501"],"summary":"### Impact\n\nAn authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service.\n","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-scaffolder-backend","publishedAt":"2026-10-07T17:59:19Z","exploitedKev":false,"fixedVersion":"3.3.1","vulnerableRange":"< 3.3.1"},{"id":"GHSA-hmp2-4m7g-22cv","title":"Backstage: Scaffolder action input authorization bypass","aliases":["CVE-2026-106503"],"summary":"### Impact\n\nAn authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources.\n\n### Patches\n\nPatched in `@","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-scaffolder-backend","publishedAt":"2026-10-07T17:59:08Z","exploitedKev":false,"fixedVersion":"3.3.1","vulnerableRange":"< 3.3.1"},{"id":"GHSA-xvgh-hmx8-9xxf","title":"Backstage: Improper task state validation in Scaffolder backend","aliases":["CVE-2026-106500"],"summary":"### Impact\n\nAn authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availabil","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-scaffolder-backend","publishedAt":"2026-10-07T17:59:02Z","exploitedKev":false,"fixedVersion":"4.1.0","vulnerableRange":"< 4.1.0"},{"id":"GHSA-p75x-jh7p-ppcx","title":"Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend","aliases":["CVE-2026-106505"],"summary":"### Impact\n\nUsers with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation.\n\n### Pa","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-techdocs-node","publishedAt":"2026-10-07T16:23:52Z","exploitedKev":false,"fixedVersion":"1.15.4","vulnerableRange":"< 1.15.4"},{"id":"GHSA-8w7q-29mw-gf5c","title":"Backstage: Improper validation of MkDocs theme configuration in TechDocs","aliases":["CVE-2026-106509"],"summary":"### Impact\n\nWhen TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in `mkdocs.yml` that cause arbitrary code execution during the documentation build process.\n\n### Patches\n","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-techdocs-node","publishedAt":"2026-10-07T16:23:30Z","exploitedKev":false,"fixedVersion":"1.15.4","vulnerableRange":"< 1.15.4"},{"id":"GHSA-f7v3-xhm6-w245","title":"Backstage has improper input validation in TechDocs Markdown extension configuration","aliases":["CVE-2026-106557"],"summary":"### Impact\n\nAn authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary. Depending on deployment configuration, this may expose sensitive backend-host data or internal network re","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@backstage\/plugin-techdocs-node","publishedAt":"2026-10-07T16:22:58Z","exploitedKev":false,"fixedVersion":"1.15.4","vulnerableRange":"< 1.15.4"},{"id":"GHSA-4ww4-68q3-h7g5","title":"Payload: Field-level write access bypass in Payload on MongoDB","aliases":["CVE-2026-106100"],"summary":"### Impact\nA vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update.\n\nYou are affected if:\nPayload version < `3.87.0` (or a `4.0.0-canary` release before `4.0.0-canary.","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@payloadcms\/db-mongodb","publishedAt":"2026-10-07T16:19:57Z","exploitedKev":false,"fixedVersion":"3.87.0","vulnerableRange":"< 3.87.0"},{"id":"GHSA-4f6c-2vvp-gw82","title":"Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write","aliases":["CVE-2026-105741"],"summary":"**Description**:\n### Summary\nAn IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (`POST \/api\/v1\/mcp\/project\/{project_id}\/install`) allowed authenticated remote attackers to bypass the \"local-only\" access restriction. By sending a s","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langflow","publishedAt":"2026-10-07T16:18:23Z","exploitedKev":false,"fixedVersion":"1.10.3","vulnerableRange":">= 1.5.0 < 1.10.3"},{"id":"GHSA-w7x8-q2gp-5cgg","title":"Flowise Prompt Injection to RCE and SSRF via CSV\/Airtable Agent Python Validator Bypass","aliases":["CVE-2026-73487"],"summary":"## Summary\n\nFlowise <= 3.1.2 CSV Agent and Airtable Agent nodes use a regex-based blocklist (`validatePythonCodeForDataFrame()`) to sanitize LLM-generated Python code before execution in Pyodide. The validator has multiple structural bypasses that allow an attacker to exfiltrate ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-10-07T16:17:21Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-9gvv-qjj3-2p6g","title":"Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium","aliases":["CVE-2026-73483"],"summary":"Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the `vm2\/@flowiseai\/nodevm` JavaScript sandbox. An authenticated user with access to the `\/api\/v1\/node-custom-function` endpoint can escape the sandbox by supplying attacker-control","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-10-07T16:17:02Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-fh39-c73x-5pjv","title":"Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions","aliases":["CVE-2026-106105"],"summary":"The `@quasar\/ssl-certificate` development utility caches a combined PEM containing a generated private key and certificate without explicitly restricting its filesystem permissions. On systems with a typical process umask, the PEM can be readable by other local users. A local att","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@quasar\/ssl-certificate","publishedAt":"2026-10-07T16:16:18Z","exploitedKev":false,"fixedVersion":"2.1.0","vulnerableRange":"<= 2.0.0"},{"id":"GHSA-r5mf-4r5x-q78f","title":"Quasar Framework: SSR\/SSG dev error page discloses the full shell environment and its <\/script> escape is bypassable","aliases":["CVE-2026-106106"],"summary":"### Summary\n\nThe error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in `process.env`, every request header and every cookie into the HTTP response, and the dev server binds `0.0.0.0` by default. Any host that can reach the p","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@quasar\/render-ssr-error","publishedAt":"2026-10-07T16:16:12Z","exploitedKev":false,"fixedVersion":"2.2.4","vulnerableRange":"<= 2.2.3"},{"id":"GHSA-5m6h-8g35-p3m7","title":"Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained","aliases":["CVE-2026-106107"],"summary":"Several @quasar\/app-vite SSR and SSG renderer paths interpolate `ssrContext.nonce` directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@quasar\/app-vite","publishedAt":"2026-10-07T16:16:03Z","exploitedKev":false,"fixedVersion":"3.3.0","vulnerableRange":"<= 3.2.0"},{"id":"GHSA-68jq-fhch-4xq4","title":"Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server","aliases":["CVE-2026-106104"],"summary":"### Summary\n\nOne unauthenticated request with a crafted `User-Agent` stalls a Quasar SSR server for seconds.\n\nQuasar auto-installs its `Platform` plugin on every server-side render, and `Platform.parseSSR()` feeds the raw, unbounded `User-Agent` request header into a chain of bac","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"quasar","publishedAt":"2026-10-07T16:14:31Z","exploitedKev":false,"fixedVersion":"2.23.3","vulnerableRange":"<= 2.23.2"},{"id":"GHSA-pq96-jpmf-w254","title":"Quasar Framework: Stored\/Reflected XSS via unescaped SSR meta tag rendering in getHead()","aliases":["CVE-2026-106102"],"summary":"## Vulnerability Details\n\n**File**: `ui\/src\/utils\/meta\/Meta.js` \u2014 actually `ui\/src\/plugins\/meta\/Meta.js` (lines 149-176: `getAttr()` and `getHead()`)\n**Sink**: `injectServerMeta()` (same file) \u2192 `ctx.headTags += getHead(data)`, interpolated verbatim into the raw HTTP response `<h","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"quasar","publishedAt":"2026-10-07T16:14:22Z","exploitedKev":false,"fixedVersion":"2.22.0","vulnerableRange":"< 2.22.0"},{"id":"GHSA-wmpw-j6qv-mw88","title":"Quasar Framework: Path Traversal \/ Arbitrary File Write via crafted Icon Genie profile","aliases":["CVE-2026-106103"],"summary":"## Vulnerability Details\n\n**File**: `icongenie\/lib\/utils\/get-assets-files.js` (line 35, `absoluteName: join(appDir, asset.folder, asset.name)`)\n**Validation gap**: `icongenie\/lib\/utils\/validate-profile-object.js` (`assetsSchema`) \u2014 `folder`\/`name` only checked with `Joi.string().","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@quasar\/icongenie","publishedAt":"2026-10-07T16:14:14Z","exploitedKev":false,"fixedVersion":"6.1.1","vulnerableRange":"< 6.1.1"},{"id":"GHSA-f46q-3v67-fmm4","title":"Homer: Authenticated SQL Injection via Unvalidated rawquery Field in \/api\/v4\/statistics\/query","aliases":["CVE-2026-62251"],"summary":"### Summary\nThe `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all da","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/sipcapture\/homer-app","publishedAt":"2026-10-07T16:13:08Z","exploitedKev":false,"fixedVersion":"0.0.0-20260625085520-a7d027dc684b","vulnerableRange":"< 0.0.0-20260625085520-a7d027dc684b"},{"id":"GHSA-6xp5-7rcx-xfgx","title":"Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login","aliases":["CVE-2026-62252"],"summary":"### Summary\nOn every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reache","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/sipcapture\/homer-app","publishedAt":"2026-10-07T16:12:02Z","exploitedKev":false,"fixedVersion":"0.0.0-20260625091610-b2e942031ff8","vulnerableRange":"< 0.0.0-20260625091610-b2e942031ff8"},{"id":"GHSA-rqcc-94gv-wjm9","title":"Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)","aliases":["CVE-2026-62253"],"summary":"### Summary\nBoth JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == \"\"`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `\/api\/v1`, `\/api\/v3`, and `\/api\/v4` are ","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/sipcapture\/homer-app","publishedAt":"2026-10-07T16:11:58Z","exploitedKev":false,"fixedVersion":"0.0.0-20260625093330-5e90809657c9","vulnerableRange":"< 0.0.0-20260625093330-5e90809657c9"},{"id":"GHSA-g6j7-pffp-8whg","title":"PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation","aliases":["CVE-2026-62176"],"summary":"### Summary\nThe `deploy\/api.py` module generates Python server code by directly interpolating the `agents_file` parameter into an f-string that is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value (via CLI argument, con","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PraisonAI","publishedAt":"2026-10-07T16:05:53Z","exploitedKev":false,"fixedVersion":"4.6.78","vulnerableRange":"<= 4.6.77"},{"id":"GHSA-7c92-x8vg-4258","title":"PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents","aliases":["CVE-2026-61436"],"summary":"# AgentMail webhook mode accepts forged unsigned message.received events and invokes agents\n\n## Summary\n\n`praisonai` AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled `message.received` JSON without verifying AgentMail's Svix webhook ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonai","publishedAt":"2026-10-07T14:07:10Z","exploitedKev":false,"fixedVersion":"4.6.78","vulnerableRange":"<= 4.6.77"},{"id":"GHSA-qj9c-59p6-8cgx","title":"PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing","aliases":["CVE-2026-61428"],"summary":"## Summary\n\nPraisonAI's AgentMail bot, when run in webhook (or hybrid) mode, starts an aiohttp webhook server bound to `0.0.0.0` and processes inbound `message.received` events **without verifying any signature\/HMAC and without authentication**. The sender address and message bod","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonai","publishedAt":"2026-10-07T14:06:56Z","exploitedKev":false,"fixedVersion":"4.6.78","vulnerableRange":"<= 4.6.77"},{"id":"GHSA-m62c-5q34-f3cf","title":"Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token","aliases":["CVE-2026-57449"],"summary":"## Summary\n\nActual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN` is configured, the proxy automatically attaches the server's GitHub token to GitHub reques","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@actual-app\/sync-server","publishedAt":"2026-10-07T14:00:45Z","exploitedKev":false,"fixedVersion":"26.7.0","vulnerableRange":"<= 26.6.0"},{"id":"GHSA-x249-cx55-2h87","title":"wger: Trainer Privilege Escalation - Improper Privilege Management","aliases":["CVE-2026-46434"],"summary":"### Summary\n\nA user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding **any one** of `gym.manage_gym`, `gym.manage_gyms`, or `gym.","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"wger","publishedAt":"2026-10-07T13:59:14Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 2.1"},{"id":"GHSA-c72h-82w6-rqfp","title":"wger: cross-tenant admin notes\/contracts leak via gym=None bypass (5 views)","aliases":["CVE-2026-43976"],"summary":"### Summary\n\nFive gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"wger","publishedAt":"2026-10-07T13:33:14Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 2.1"},{"id":"GHSA-vv44-hjm2-qw2f","title":"Duplicate Advisory: Remote code execution via unsafe deserialization in multiprocess mode transport","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-w5f2-9q9c-ff4h. This link is maintained to preserve external references.\n\n## Original Description\nLMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROU","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lmcache","publishedAt":"2026-10-07T12:31:58Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.3.9 < 0.5.6"},{"id":"GHSA-6r3q-mjv7-xr8m","title":"Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding","aliases":["CVE-2026-41510"],"summary":"## Root Cause\n\nFile: `internal\/corazawaf\/transaction.go`, lines 770\u2013808 (since commit 2fd87b89, PR #812, 2023-06-14)\n\n```go\nfunc (tx *Transaction) AddGetRequestArgument(key string, value string) {\n    if tx.checkArgumentLimit(tx.variables.argsGet) {\n        tx.debugLogger.Warn().","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/corazawaf\/coraza\/v3","publishedAt":"2026-10-06T20:38:03Z","exploitedKev":false,"fixedVersion":"3.8.1","vulnerableRange":">= 3.0.0 < 3.8.1"},{"id":"GHSA-mc52-mwq4-vfx3","title":"knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns\/config.json","aliases":["CVE-2026-86540"],"summary":"## Overview\n\nA critical **Arbitrary Code Execution (ACE)** vulnerability exists in the Knowns Language Server Protocol (LSP) detection and startup pipeline. The system blindly trusts the `settings.lsp.languages.<lang>.binary` field defined in the project-level `.knowns\/config.jso","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"knowns","publishedAt":"2026-10-06T18:58:38Z","exploitedKev":false,"fixedVersion":"0.30.0","vulnerableRange":"<= 0.29.1"},{"id":"GHSA-fx49-4h83-wjv9","title":"Payload didn't enforce field-level password update restrictions","aliases":["CVE-2026-105855"],"summary":"## Impact\n\nWhen an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly.\n\n## Patches\n\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-06T16:21:52Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":"< 3.90.0"},{"id":"GHSA-2g7p-5934-q4w7","title":"Payload: ReDoS in Multipart Content-Type Validation","aliases":["CVE-2026-105854"],"summary":"## Impact\nA malformed multipart request body could take an extremely long time to finish.\n\n## Patches\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-06T16:18:27Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":">= 3.0.0 < 3.90.0"},{"id":"GHSA-238x-w2j9-gwwr","title":"Payload vulnerable to API key disclosure through ordinary document reads","aliases":["CVE-2026-105849"],"summary":"### Impact\n\nUsers with read access to other user documents could access their active API keys. An exposed key grants the target account\u2019s permissions until rotated or disabled.\n\nYou are affected if:\n\n- An authentication collection enables `useAPIKey`.\n- Users have read access to ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-06T16:18:16Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":">= 3.0.0 < 3.90.0"},{"id":"GHSA-8r29-2mp2-pmrw","title":"Payload Ecommerce has an order confirmation validation issue","aliases":["CVE-2026-105850"],"summary":"## Impact\nWhen using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions.\n\nYou are affected if:\n- You use `@payloadcms\/plugin-ecommerce` with the Stripe payment adapter.\n\nDeployments that do not use the Stripe payment flow ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@payloadcms\/plugin-ecommerce","publishedAt":"2026-10-06T16:17:54Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":"< 3.90.0"},{"id":"GHSA-xgv3-crq2-6f69","title":"Payload: Token refresh and password reset responses may expose restricted user fields","aliases":["CVE-2026-105853"],"summary":"## Impact\n\nToken refresh and password reset responses could return fields that the requesting user did not have access to.\n\nYou are affected if:\n\n- An authentication collection contains hidden or read-restricted fields.\n\n## Patches\n\nAuthentication responses now apply field access","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-06T16:17:28Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":">= 3.0.0 < 3.90.0"},{"id":"GHSA-vc4h-q48j-5hcx","title":"Payload: Field access control bypass on auth collections","aliases":["CVE-2026-105851"],"summary":"## Impact\n\nPayload's duplicate operation copies field values from the source document even when a field is hidden, or its `access.read` or `access.create` rule would reject the value for that caller.\n\nThe `disableDuplicate` collection setting, enabled by default on auth collectio","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-06T16:17:23Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":"> 3.0.0 < 3.90.0"},{"id":"GHSA-2q76-m6w6-qgc6","title":"Payload: Improper access control for MCP API keys","aliases":["CVE-2026-105806"],"summary":"### Impact\nUnder certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover.\n\nApplications that do not use `@payloadcms\/plugin-mcp` are not affected.\n\n### Patches\nUsers sh","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@payloadcms\/plugin-mcp","publishedAt":"2026-10-06T16:09:31Z","exploitedKev":false,"fixedVersion":"3.88.0","vulnerableRange":">= 3.61.0 < 3.88.0"},{"id":"GHSA-qf28-8hc6-vwrp","title":"Payload: Prototype pollution in Payload Import Export plugin","aliases":["CVE-2026-105844"],"summary":"### Impact\nAn unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code (RCE).\n\nApplications that do not use `@payloadcms\/plugin-import-export` are not affected.\n\n### Patches\nU","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@payloadcms\/plugin-import-export","publishedAt":"2026-10-06T16:09:23Z","exploitedKev":false,"fixedVersion":"3.88.0","vulnerableRange":">= 3.0.0 < 3.88.0"},{"id":"GHSA-v49j-62m6-pgrr","title":"Payload: SQL Injection in SQLite and Postgres","aliases":["CVE-2026-105845"],"summary":"### Impact\nA user can submit a request that exploits a SQL Injection vulnerability in Payload.\n\nYou are affected if:\n- You use an affected Payload version.\n- Untrusted users can query readable collections using dynamic filters or joins.\n\nYou are not affected if you use MongoDB (`","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-06T16:09:17Z","exploitedKev":false,"fixedVersion":"3.88.0","vulnerableRange":">= 3.0.0 < 3.88.0"},{"id":"GHSA-fpww-c55p-cjv6","title":"Payload: Polymorphic join queries could disclose hidden fields","aliases":["CVE-2026-105847"],"summary":"### Impact\n\nA user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens.\n\nYou are affected if:\n\n- You use an affected Payload version.\n- Users can query a collection with a polymorphic join to sensit","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"payload","publishedAt":"2026-10-06T16:09:04Z","exploitedKev":false,"fixedVersion":"3.90.0","vulnerableRange":">= 3.0.0 < 3.90.0"},{"id":"GHSA-6qxp-vccf-f47h","title":"MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server","aliases":["CVE-2026-104850"],"summary":"### Summary\nIn affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to.\n\nA malicious or compromised MCP server could name its own a","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@modelcontextprotocol\/sdk","publishedAt":"2026-10-06T15:35:44Z","exploitedKev":false,"fixedVersion":"1.31.0","vulnerableRange":">= 1.12.0 < 1.31.0"},{"id":"GHSA-5293-mq8x-g3xj","title":"openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation","aliases":["CVE-2026-105801"],"summary":"### Impact\nA malicious OpenAPI document processed by any `openapi-python-client` prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute.\n\n### Patches\nVersions starting with 0.29.1 have updated with gua","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"openapi-python-client","publishedAt":"2026-10-06T15:32:53Z","exploitedKev":false,"fixedVersion":"0.29.1","vulnerableRange":"< 0.29.1"},{"id":"GHSA-q7hv-xx6h-q2x8","title":"External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration","aliases":["CVE-2026-26287"],"summary":"## Summary\nA bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io\/type=webhook` being skipped (and the operation to succeed while it sho","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/external-secrets\/external-secrets","publishedAt":"2026-10-06T15:29:25Z","exploitedKev":false,"fixedVersion":"1.3.2","vulnerableRange":">= 0.10.0 < 1.3.2"},{"id":"GHSA-wq5f-xc86-pv6w","title":"sharp : Vulnerability in librsvg dependency CVE-2026-96889","aliases":[],"summary":"### Impact\n\nA memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux.\n\n### Patches\n\n#### Using prebuilt","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"sharp","publishedAt":"2026-10-06T13:43:57Z","exploitedKev":false,"fixedVersion":"0.35.5","vulnerableRange":"< 0.35.5"},{"id":"GHSA-pqg4-j6r4-53mv","title":"shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token","aliases":["CVE-2026-102422"],"summary":"### Impact\n\n`quote()` emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as sh","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"shell-quote","publishedAt":"2026-10-06T13:40:36Z","exploitedKev":false,"fixedVersion":"1.11.0","vulnerableRange":">= 1.8.4 < 1.11.0"},{"id":"GHSA-8qpj-27x8-pwpq","title":"Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation","aliases":["CVE-2026-10561"],"summary":"### Summary\n\nLangflow's built-in Python interpreter components \u2014 `PythonREPLComponent` (Python Interpreter) and the legacy `PythonREPLToolComponent` (Python REPL Tool) \u2014 executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the ","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langflow","publishedAt":"2026-10-06T13:38:28Z","exploitedKev":false,"fixedVersion":"1.10.1","vulnerableRange":"< 1.10.1"},{"id":"GHSA-v5rq-49vh-5v5c","title":"simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection","aliases":["CVE-2026-102829"],"summary":"# Security control bypass in `@simple-git\/argv-parser`: Git's `VISUAL` editor fallback is not classified as `allowUnsafeEditor`\n\n## Report metadata\n\n| Field | Value |\n| --- | --- |\n| Package | `@simple-git\/argv-parser` (npm, `pkg:npm\/%40simple-git\/argv-parser`) |\n| Repository | h","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@simple-git\/argv-parser","publishedAt":"2026-10-05T23:48:21Z","exploitedKev":false,"fixedVersion":"2.0.1","vulnerableRange":"< 2.0.1"},{"id":"GHSA-x6jw-m9v5-85vh","title":"simple-git unsafe-operation guard does not block trailer command configuration","aliases":["CVE-2026-102828"],"summary":"## Affected product\n\nThe default `blockUnsafeOperationsPlugin` in `simple-git` when an application permits untrusted values to reach `SimpleGitOptions.config` or Git inline configuration arguments such as `-c <key>=<value>`.\n\n## Summary\n\n`trailer.<token>.cmd` is not recognized as","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"simple-git","publishedAt":"2026-10-05T23:48:14Z","exploitedKev":false,"fixedVersion":"4.0.1","vulnerableRange":">= 3.15.0 < 4.0.1"},{"id":"GHSA-g4wm-2vf7-vfgr","title":"simple-git allows command execution through unblocked Git configuration includes","aliases":["CVE-2026-102826"],"summary":"## Summary\n\nAn OS command injection vulnerability in `git.clone()` allows any application that flows attacker-influenced data into `customArgs` to execute arbitrary code. simple-git 3.36.0 (current latest on npm) ships without any `include.path` entry in the `blockUnsafeOperation","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"simple-git","publishedAt":"2026-10-05T23:48:05Z","exploitedKev":false,"fixedVersion":"4.0.0","vulnerableRange":"<= 3.36.0"},{"id":"GHSA-858h-whjf-mvg5","title":"simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p\/--exe) -> command execution (residual of CVE-2026-28291)","aliases":["CVE-2026-102827"],"summary":"simple-git's blockUnsafeOperationsPlugin blocks dangerous git options (--upload-pack\/--receive-pack\/--exec\/...) unless the consumer opts in via unsafe:{allowUnsafePack:true}. Detection (@simple-git\/argv-parser detectVulnerableFlags) matches the parsed flag NAME against literal-sp","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"simple-git","publishedAt":"2026-10-05T23:47:58Z","exploitedKev":false,"fixedVersion":"4.0.0","vulnerableRange":"<= 3.36.0"},{"id":"GHSA-v4x9-3549-crwv","title":"PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding","aliases":["CVE-2026-96749"],"summary":"An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guar","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pymongo","publishedAt":"2026-10-05T23:47:10Z","exploitedKev":false,"fixedVersion":"4.18.2","vulnerableRange":"< 4.18.2"},{"id":"GHSA-vp6j-j7w5-5xjj","title":"PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters","aliases":["CVE-2026-96748"],"summary":"### Summary\n\nPyMongo percent-decoded the entire host section of a connection string before splitting it into individual `host:port` entries. A percent-encoded `,` or `:` in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port i","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pymongo","publishedAt":"2026-10-05T23:47:07Z","exploitedKev":false,"fixedVersion":"4.18.2","vulnerableRange":">= 3.5.0 <= 4.18.1"},{"id":"GHSA-wfpm-5gcm-94cg","title":"Socket.IO: Prototype Pollution via Unsafe Client Session Lookup","aliases":["CVE-2026-102600"],"summary":"### Impact\n\nThis is a **prototype pollution \/ improper client lookup** vulnerability in `@socket.io\/cluster-engine`.\n\nServers using `@socket.io\/cluster-engine` may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could us","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@socket.io\/cluster-engine","publishedAt":"2026-10-05T23:44:21Z","exploitedKev":false,"fixedVersion":"0.1.1","vulnerableRange":"< 0.1.1"},{"id":"GHSA-p6vx-979v-rg4c","title":"Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)","aliases":["CVE-2026-104846"],"summary":"A fulfilled Promise node deserialized by `fromJSON()` can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in `seroval@1.5.3` (GHSA-mv8w-475r-vwqw \/ CVE-2026-59940) and affects every ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"seroval","publishedAt":"2026-10-05T23:40:43Z","exploitedKev":false,"fixedVersion":"1.6.2","vulnerableRange":">= 0.12.0 <= 1.6.0"},{"id":"GHSA-jp82-f5mq-hwhp","title":"Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization","aliases":["CVE-2026-104845"],"summary":"# Summary\n\ndeserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"seroval","publishedAt":"2026-10-05T23:40:40Z","exploitedKev":false,"fixedVersion":"1.6.3","vulnerableRange":"<= 1.6.2"},{"id":"GHSA-jqcg-44mw-7w3h","title":"proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet","aliases":["CVE-2026-90711"],"summary":"### Impact\n\n`proxy-addr` determines which network hops are trusted proxies so that `X-Forwarded-For` can be believed. When an application configures a trust subnet as an IPv4-mapped IPv6 address with a short prefix, such as `::ffff:10.0.0.0\/8` (the correct spelling is `::ffff:10.","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"proxy-addr","publishedAt":"2026-10-05T23:30:26Z","exploitedKev":false,"fixedVersion":"2.0.8","vulnerableRange":">= 1.1.0 < 2.0.8"},{"id":"GHSA-6vc5-vf29-ffr2","title":"@nx\/docker: OS command injection in the @nx\/docker release pipeline","aliases":["CVE-2026-104859"],"summary":"## Summary\n\nThe `@nx\/docker` release pipeline builds its `docker` invocations as shell command strings, interpolating `release.docker.repositoryName` and `registryUrl` from Nx configuration into them. Because those strings are handed to `\/bin\/sh -c`, a crafted repository or regis","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@nx\/docker","publishedAt":"2026-10-05T23:29:13Z","exploitedKev":false,"fixedVersion":"22.7.8","vulnerableRange":">= 21.4.0 < 22.7.8"},{"id":"GHSA-w2vw-w76x-qr89","title":"Nx: OS command injection via git revisions and remote refs","aliases":[],"summary":"## Summary\n\nNx core builds several `git` invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by `\/bin\/sh` instead. Two entry points are reachable by an attacker: `affected` commands, where `d","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nx","publishedAt":"2026-10-05T23:29:06Z","exploitedKev":false,"fixedVersion":"22.7.8","vulnerableRange":">= 14.0.0 < 22.7.8"},{"id":"GHSA-w3vv-58gj-gw77","title":"Nx daemon and plugin worker sockets are accessible to other local users","aliases":["CVE-2026-104854"],"summary":"## Summary\n\nNx creates the Unix domain sockets for its daemon and its plugin workers in a shared temporary directory with default permissions, so any other user on the same machine can connect to them. The daemon accepts a `PROCESS_IN_BACKGROUND` request that names a module to lo","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nx","publishedAt":"2026-10-05T23:28:43Z","exploitedKev":false,"fixedVersion":"22.7.9","vulnerableRange":">= 14.6.0 < 22.7.9"},{"id":"GHSA-vc2v-76pw-4v95","title":"compression vulnerable to Denial of Service via memory leak on premature response close","aliases":["CVE-2026-87776"],"summary":"### Impact\n\nA vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that re","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"compression","publishedAt":"2026-10-05T23:28:01Z","exploitedKev":false,"fixedVersion":"1.8.2","vulnerableRange":"< 1.8.2"},{"id":"GHSA-5h3f-q97h-ccvc","title":"vm2: NodeVM custom resolution bypasses external path boundaries","aliases":["CVE-2026-100721"],"summary":"## Summary\n\nAt source revision `91034466bfb7f56b95fd48083ec6ca36d058f164` of vm2 3.11.8, an untrusted `NodeVM` guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. `LegacyResolver.","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-05T23:24:29Z","exploitedKev":false,"fixedVersion":"3.12.2","vulnerableRange":"<= 3.12.1"},{"id":"GHSA-2v2p-6j97-cjg9","title":"vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process","aliases":["CVE-2026-100722"],"summary":"## Summary\n\nAn untrusted script run by `VM.run` can construct an embedder-exposed host function that returns a rejected native Promise and ignore the result. The sandbox-to-host `construct` trap forwards that Promise without applying the host-side rejection handling already used ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-05T23:19:55Z","exploitedKev":false,"fixedVersion":"3.12.2","vulnerableRange":"<= 3.12.1"},{"id":"GHSA-6fw5-9hq8-w87g","title":"GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor","aliases":["CVE-2026-103921"],"summary":"## Impact\n\n`buildWSLegacyExecutor()` in `@graphql-tools\/executor-legacy-ws` previously hardcoded `rejectUnauthorized: false` when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Midd","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@graphql-tools\/executor-legacy-ws","publishedAt":"2026-10-05T22:56:56Z","exploitedKev":false,"fixedVersion":"1.1.35","vulnerableRange":"<= 1.1.34"},{"id":"GHSA-7mx3-vvmw-hjmv","title":"GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`","aliases":["CVE-2026-104852"],"summary":"Closed by https:\/\/github.com\/ardatan\/graphql-tools\/pull\/8423\nMitigated in Hive Gateway by https:\/\/github.com\/graphql-hive\/gateway\/pull\/2600\n\nA client can alias fields to `constructor`, `__proto__` or `prototype` so that the response keys from two subgraphs collide on those names ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@graphql-tools\/utils","publishedAt":"2026-10-05T22:56:46Z","exploitedKev":false,"fixedVersion":"12.0.1","vulnerableRange":"<= 12.0.0"},{"id":"GHSA-6w6g-hm98-mhgm","title":"hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)","aliases":[],"summary":"When the `hickory-resolver` name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just an","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"hickory-resolver","publishedAt":"2026-10-05T22:55:10Z","exploitedKev":false,"fixedVersion":"0.26.2","vulnerableRange":">= 0.26.0-beta.1 < 0.26.2"},{"id":"GHSA-5j98-2g5x-46v6","title":"hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures","aliases":[],"summary":"When calling `Resolver::lookup()` or `Resolver::lookup_ip()` on a resolver with DNSSEC validation enabled, both methods return `Ok(...)` if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should ins","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"hickory-resolver","publishedAt":"2026-10-05T22:54:35Z","exploitedKev":false,"fixedVersion":"0.26.2","vulnerableRange":"< 0.26.2"},{"id":"GHSA-27vj-qcqg-25rc","title":"fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution","aliases":["CVE-2026-104851"],"summary":"### Summary\n\n`fsspec.implementations.reference.ReferenceFileSystem` parses a \"references\"\nJSON document (Kerchunk format) supplied either inline or via a URL. The\nparser renders fields from this JSON through **un-sandboxed**\n`jinja2.Template(...).render(...)` calls in three locat","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"fsspec","publishedAt":"2026-10-05T22:53:22Z","exploitedKev":false,"fixedVersion":"2026.6.0","vulnerableRange":">= 0.9.0 < 2026.6.0"},{"id":"GHSA-rvm3-566m-v7fv","title":"Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path","aliases":["CVE-2026-103922"],"summary":"### Impact\n\nCapacitor's WebView navigation guard validated only the **host and scheme** of a\ntarget URL, not its **path**. Because the internal HTTP proxy path\n(`\/_capacitor_http_interceptor_`) is served at the application's own origin, a\nframe navigation to it was always treated","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@capacitor\/android","publishedAt":"2026-10-05T22:53:10Z","exploitedKev":false,"fixedVersion":"6.2.2","vulnerableRange":">= 6.0.0 < 6.2.2"},{"id":"GHSA-g2v6-rqmx-r4w6","title":"@vue\/server-renderer: XSS via missing CR in attribute-name blacklist","aliases":[],"summary":"## Description\n\n`@vue\/server-renderer` was investigated specifically because it's the one place in Vue where template rendering output becomes a real HTTP response body -- a genuine server-side trust boundary, unlike client-side rendering which only ever affects the same browser ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@vue\/server-renderer","publishedAt":"2026-10-05T22:50:55Z","exploitedKev":false,"fixedVersion":"3.5.42","vulnerableRange":"< 3.5.42"},{"id":"GHSA-5gmw-xhrv-c9v3","title":"Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution","aliases":["CVE-2026-104848"],"summary":"`tinypool` passes worker options to `new Worker()` by reading them off a plain object whose prototype is `Object.prototype`. Options the application did not set are resolved through the prototype chain and then passed explicitly to `worker_threads.Worker`.\n\nNode core ignores `Wor","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"tinypool","publishedAt":"2026-10-05T22:50:01Z","exploitedKev":false,"fixedVersion":"2.1.1","vulnerableRange":"<= 2.1.0"},{"id":"GHSA-85c8-ppgw-ccpr","title":"Tinypool: Prototype Pollution Gadget to RCE in run() options","aliases":["CVE-2026-104849"],"summary":"`tinypool` is a fork of `piscina` and inherited the same prototype-pollution surface. When `pool.run(task, options)` is called, the `filename` option is read from the provided `options` object. If that object does not have an own `filename` property, the lookup falls through to `","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"tinypool","publishedAt":"2026-10-05T22:49:52Z","exploitedKev":false,"fixedVersion":"2.1.2","vulnerableRange":"< 2.1.2"},{"id":"GHSA-v853-p72q-4cfw","title":"Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__","aliases":[],"summary":"### Summary\nQuart 0.23.0 contains a stray debug statement (`print(data)`) inside `Body.__await__` in `quart\/wrappers\/request.py`. Any request whose body is awaited \u2014 `await request.form`, `await request.get_data()`, WTForms `validate_on_submit()`, etc. \u2014 has its raw, unparsed bod","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"quart","publishedAt":"2026-10-05T22:49:44Z","exploitedKev":false,"fixedVersion":"0.23.1","vulnerableRange":"= 0.23.0"},{"id":"GHSA-fvww-7h3r-vfhp","title":"LangGraph SDK custom auth silently ignores actions= on resource decorators","aliases":["CVE-2026-104873"],"summary":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n`langgraph-sdk` incorrectly applies the `actions=` argument on resource-scoped authorization decorators, including `@auth.on.threads`, `@auth.on.assistants`, and `@auth.on.crons`.\n\nIn affected versions, a decorator s","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langgraph-sdk","publishedAt":"2026-10-05T22:49:35Z","exploitedKev":false,"fixedVersion":"0.4.4","vulnerableRange":">= 0.1.45 <= 0.4.3"},{"id":"GHSA-f8gf-w286-fmq2","title":"vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM","aliases":["CVE-2026-92959"],"summary":"### Summary\n\nWhen `allowAsync` is set to `false`, vm2 is expected to reject attempts to run asynchronous code. Direct use of `Promise.prototype.then` is blocked, but Promise static methods still assimilate attacker-controlled thenables. `Promise.resolve(thenable)`, `Promise.all([","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-05T22:47:34Z","exploitedKev":false,"fixedVersion":"3.11.8","vulnerableRange":"<= 3.11.7"},{"id":"GHSA-88hf-g992-jg85","title":"vm2: Sandbox Escape (NodeVM)","aliases":["CVE-2026-92955"],"summary":"## Summary\n\nIt being possible to obtain the host `__proto__` getter\/setter, has been used in many reports:\n\n- https:\/\/github.com\/patriksimek\/vm2\/security\/advisories\/GHSA-vwrp-x96c-mhwq\n- https:\/\/github.com\/patriksimek\/vm2\/security\/advisories\/GHSA-v6mx-mf47-r5wg\n- https:\/\/github.c","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-05T22:47:09Z","exploitedKev":false,"fixedVersion":"3.11.8","vulnerableRange":"<= 3.11.7"},{"id":"GHSA-gjq8-xm47-88rc","title":"vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process","aliases":["CVE-2026-92954"],"summary":"## Summary\n\nvm2 current head (`v3.11.5`, commit `7a1f5100b96f48d34e0fe104ab37c0acc5944f92`) can still be used to terminate the host Node.js process when sandbox code calls a host-realm function that returns a rejected host Promise and then ignores the returned value.\n\nThis is an ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-05T22:45:48Z","exploitedKev":false,"fixedVersion":"3.11.8","vulnerableRange":">= 3.10.0 <= 3.11.7"},{"id":"GHSA-3vgf-8m4q-q4qr","title":"vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix","aliases":["CVE-2026-92953"],"summary":"## Summary\n\nvm2's current host-intrinsic prototype protection is incomplete. The fix for `GHSA-vwrp-x96c-mhwq` blocks sandbox writes into classic host intrinsics such as `Object.prototype`, `Array.prototype`, and `Function.prototype`, but current head still lets sandbox code in a","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-05T22:45:22Z","exploitedKev":false,"fixedVersion":"3.11.8","vulnerableRange":">= 3.11.0 <= 3.11.7"},{"id":"GHSA-x965-fc75-jpqh","title":"vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit","aliases":["CVE-2026-92934"],"summary":"## Summary\nvm2 `3.11.6` (this fork's latest release) contains an incomplete-fix bypass of the Error.cause host-reference sanitization added in GHSA-m283-3h24-438v (commit `7e3faaf`). Sandbox code that catches a host-wrapped `AggregateError` which is *revisited within a single `ha","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-05T22:38:04Z","exploitedKev":false,"fixedVersion":"3.11.8","vulnerableRange":"<= 3.11.7"},{"id":"GHSA-c8x8-7fp4-3x9w","title":"ProseMirror has a XSS vulnerability in prosemirror-view's paste handling","aliases":["CVE-2026-104847"],"summary":"### Impact\n\nWhen a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor.\n\n### Patches\n\nVersion 1.42.3 adds validation that prevents this attack.\n\n### Workaroun","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"prosemirror-view","publishedAt":"2026-10-05T22:36:06Z","exploitedKev":false,"fixedVersion":"1.42.3","vulnerableRange":"< 1.42.3"},{"id":"GHSA-r4fx-v8hh-22mv","title":"vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)","aliases":["CVE-2026-92942"],"summary":"### Vulnerability Summary\n \nvm2's `VM({ timeout })` option is documented and relied upon as the mechanism that bounds how long sandboxed code may execute. In the current implementation, the timeout only wraps the single synchronous call to `VM#run()` (via `doWithTimeout` \u2192 `this.","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-05T22:35:04Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":"<= 3.11.6"},{"id":"GHSA-j3hm-6rg5-mchv","title":"vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE","aliases":["CVE-2026-92946"],"summary":"## Summary\n\n`NodeVM`'s `require.external` option lets sandboxed code `require()` local files and npm packages. When `require.external` is enabled and `require.root` is **not explicitly set to a path that excludes `node_modules`**, two defaults combine to fully defeat the sandbox:","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-05T22:34:50Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":"<= 3.11.6"},{"id":"GHSA-fcqc-726x-5wfc","title":"vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool","aliases":["CVE-2026-92947"],"summary":"### Summary\nSandboxed code is able to disclose host memory used by small allocations by `Buffer.from`, `Buffer.concat`.\n\n### Details\nvm2 exposes `Buffer` object to sandboxed code by default. Small [`Buffer` allocations](https:\/\/nodejs.org\/api\/buffer.html#static-method-bufferalloc","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-05T22:34:35Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":"<= 3.11.6"},{"id":"GHSA-wjwh-qqvp-g4p4","title":"vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass","aliases":["CVE-2026-92956"],"summary":"## Summary\n\nThere is a sandbox escape in vm2 `3.11.5` \/ current HEAD when it is used on Node.js 26. The issue is reachable from a default `new VM()` sandbox. No `NodeVM`, `require` permission, host object injection, or intentionally unsafe configuration is required.\n\nThe escape i","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-05T22:34:22Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":">= 3.10.1 <= 3.11.6"},{"id":"GHSA-jxw3-mjmx-3pqm","title":"Langflow: Weak Fernet Key via random.seed()","aliases":["CVE-2026-9205"],"summary":"### Summary\n\nLangflow uses Python's `random` module (Mersenne Twister, a non-cryptographic PRNG) seeded with the `SECRET_KEY` to derive the Fernet encryption key for all stored user credentials (API keys, LLM provider secrets, database passwords). When the `SECRET_KEY` is shorter","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langflow","publishedAt":"2026-10-05T22:31:35Z","exploitedKev":false,"fixedVersion":"1.10.1","vulnerableRange":"<= 1.10.0"},{"id":"GHSA-cf6m-vc3m-7cgm","title":"Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass","aliases":["CVE-2026-8505"],"summary":"### Summary\nA vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the `WEBHOOK_AUTH_ENABLE` configuration is set to `False`. This allows a remote attack","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langflow","publishedAt":"2026-10-05T22:31:22Z","exploitedKev":false,"fixedVersion":"1.9.1","vulnerableRange":">= 1.7.0 <= 1.9.0"},{"id":"GHSA-w584-2h2r-2hvf","title":"Langflow: Title Authenticated Remote Code Execution in  validate_code  via Malicious Decorators  Description","aliases":["CVE-2026-51886"],"summary":"###Summary:\nA critical Authenticated Remote Code Execution (RCE) vulnerability exists in the validate_code  function of Langflow. The` \/api\/v1\/validate\/code` endpoint, meant to validate user-supplied code, leverages Python's exec()  function. While it attempts to restrict executi","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langflow","publishedAt":"2026-10-05T22:31:00Z","exploitedKev":false,"fixedVersion":"1.10.1","vulnerableRange":">= 1.7.2 < 1.10.1"},{"id":"GHSA-9fpm-3445-2vx4","title":"Langflow: Prompt injection in Langflow Smart Transform can lead to code execution","aliases":["CVE-2026-7700"],"summary":"## Summary\n\nLangflow versions 1.3.0 through 1.10.2 contain a code-injection vulnerability in the Smart Transform (`LambdaFilterComponent`) component.\n\nSmart Transform places flow-author instructions and a preview of its input data into a prompt asking an LLM to generate a Python ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langflow","publishedAt":"2026-10-05T22:30:41Z","exploitedKev":false,"fixedVersion":"1.10.3","vulnerableRange":">= 1.3.0 < 1.10.3"},{"id":"GHSA-x4q3-gcj3-m6cf","title":"gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled","aliases":["CVE-2026-73802"],"summary":"### Summary\nact_runner appends workflow-controlled `jobs.<job>.container.options` directly \nto the Docker HostConfig for the job container. When runner privileged mode is \ndisabled, only `Privileged` is forced false. Host namespace flags, capability \nexpansion, and security profi","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"gitea.com\/gitea\/runner","publishedAt":"2026-10-02T23:18:12Z","exploitedKev":false,"fixedVersion":"1.0.9-0.20260731160927-34bfa1915022","vulnerableRange":"< 1.0.9-0.20260731160927-34bfa1915022"},{"id":"GHSA-gjj5-9665-rwrc","title":"probe-image-size: Quadratic-time Denial of Service in the SVG Parser","aliases":["CVE-2026-104861"],"summary":"## Overview\n\n`probe-image-size` scans the SVG header with a searching regular expression, `\/<[-_.:a-zA-Z0-9][^>]*>\/`. On input that contains many `<` characters but no `>`, the engine restarts the `[^>]*` scan at every `<` position and runs to end of input each time, giving quadr","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"probe-image-size","publishedAt":"2026-10-02T23:18:02Z","exploitedKev":false,"fixedVersion":"7.4.0","vulnerableRange":"<= 7.3.0"},{"id":"GHSA-x8gv-g2g3-65fj","title":"SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)","aliases":[],"summary":"# Security Advisory \u2014 SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of `CheckHostSSRF`)\n\n| Field | Value |\n|---|---|\n| **Disclosed by** | joysinleung (`joysinleung@gmail.com`) |\n| **Report date** | 2026-08-13 |\n| **Product** | SiYuan (\u601d\u6e90\u7b14\u8bb0) \u2014 `siyuan-note\/siyuan` |\n| *","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-10-02T23:17:16Z","exploitedKev":false,"fixedVersion":"0.0.0-20260813142806-dd2778b70d02","vulnerableRange":"< 0.0.0-20260813142806-dd2778b70d02"},{"id":"GHSA-x8mw-p69m-v3mx","title":"@fastify\/busboy vulnerable to Denial of Service via prototype-named multipart part header","aliases":["CVE-2026-19481"],"summary":"### Impact\n\nVersions of `@fastify\/busboy` from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named `__proto__` or `constructor` resolves to an inherited value tha","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@fastify\/busboy","publishedAt":"2026-10-02T23:16:36Z","exploitedKev":false,"fixedVersion":"3.2.1","vulnerableRange":">= 1.0.0 < 3.2.1"},{"id":"GHSA-xjh9-v7x6-24jw","title":"@fastify\/busboy vulnerable to Denial of Service via oversized multipart boundary","aliases":["CVE-2026-19484"],"summary":"### Impact\n\nVersions of `@fastify\/busboy` from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a `Uint8Array(256)`. A multipart boundary of exactly 252 bytes makes the search needle 256 by","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@fastify\/busboy","publishedAt":"2026-10-02T23:16:17Z","exploitedKev":false,"fixedVersion":"3.2.1","vulnerableRange":">= 3.1.0 < 3.2.1"},{"id":"GHSA-cjcg-cxmh-9wcr","title":"Praxis affected by HTTP\/2 Bomb ","aliases":[],"summary":"### Summary\n\nMultiple denial-of-service vulnerabilities have been discovered in HTTP\/2 server implementations. All have been rated with a severity impact of [Important](https:\/\/access.redhat.com\/security\/updates\/classification). The vulnerabilities target HPACK, the header compre","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"praxis-proxy","publishedAt":"2026-10-02T23:09:37Z","exploitedKev":false,"fixedVersion":"0.5.2","vulnerableRange":"< 0.5.2"},{"id":"GHSA-h46j-26q3-rggf","title":"Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)","aliases":["CVE-2026-71416"],"summary":"### Summary\nThe Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be e","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"headroom-ai","publishedAt":"2026-10-02T23:09:15Z","exploitedKev":false,"fixedVersion":"0.35.0","vulnerableRange":"< 0.35.0"},{"id":"GHSA-4vpg-gwqq-w44c","title":"SiYuan: 17 block metadata\/content endpoints in kernel\/api\/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers","aliases":["CVE-2026-74904"],"summary":"Same CWE-862 family, found via an automated bulk sweep of every\n`\/api\/block\/*` handler in `kernel\/api\/block.go` for the presence of any\naccess-check reference (`IsReadOnlyRoleContext`, `checkBlockPublishAccess`,\n`GetPublishAccess`) anywhere in the function body. 17 of 28 candidat","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-10-02T23:05:33Z","exploitedKev":false,"fixedVersion":"0.0.0-20260804015139-bd067a4fe9b2","vulnerableRange":"< 0.0.0-20260804015139-bd067a4fe9b2"},{"id":"GHSA-72qq-p3r5-f7wq","title":"@a2ui\/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions","aliases":["CVE-2026-10032"],"summary":"### Summary\n\nThe `openUrl` function in `@a2ui\/web_core` passes an agent-controlled URL directly to `window.open()` without validating the URI scheme. A malicious agent can supply a `javascript:` URI as the `url` argument of a `Button` component's `functionCall` action. When the u","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@a2ui\/web_core","publishedAt":"2026-10-02T22:55:49Z","exploitedKev":false,"fixedVersion":"0.10.2","vulnerableRange":">= 0.9.0 < 0.10.2"},{"id":"GHSA-8ffr-xgwf-xj56","title":"aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers","aliases":["CVE-2026-18140"],"summary":"### Summary\nSmithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-ke","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"aws-smithy-json","publishedAt":"2026-10-02T22:44:52Z","exploitedKev":false,"fixedVersion":"0.62.7","vulnerableRange":"<= 0.62.6"},{"id":"GHSA-v2f8-6655-7grj","title":"Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain","aliases":[],"summary":"### Summary: \n5 findings \u2014 unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persists even with `API_AUTH_KEY` set (F2), unauthenticated file write of `.py`\/`.sh`\/`.yaml` to a server-returned path (F3), default-permissive CORS that combines w","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"vibe-trading-ai","publishedAt":"2026-10-02T22:44:26Z","exploitedKev":false,"fixedVersion":"0.1.7","vulnerableRange":">= 0.1.0 < 0.1.7"},{"id":"GHSA-5rmq-chc7-m22f","title":"Vibe-Trading file-read tools expose arbitrary server-readable files","aliases":[],"summary":"### Summary: \n2 findings \u2014 `safe_user_path()` accepts any path under `Path.home()` or `Path.cwd()`, which inside the shipped root container resolves to `\/root` and `\/app` (so all of root's home, including `\/root\/.ssh\/id_rsa`, `\/root\/.aws\/credentials`, `\/root\/.kube\/config`, and `\/","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"vibe-trading-ai","publishedAt":"2026-10-02T22:44:12Z","exploitedKev":false,"fixedVersion":"0.1.7","vulnerableRange":">= 0.1.0 < 0.1.7"},{"id":"GHSA-jqmf-mx4f-hfr6","title":"Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF","aliases":[],"summary":"### Summary: \n5 findings \u2014 `BashTool` shell-injection sink (F6, the canonical RCE primitive), `BackgroundRunTool` async shell-injection sink (F7), backtest `exec_module()` runs top-level statements before the `SignalEngine` class check (F8 \u2014 independent RCE path that does not mat","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"vibe-trading-ai","publishedAt":"2026-10-02T22:44:03Z","exploitedKev":false,"fixedVersion":"0.1.7","vulnerableRange":">= 0.1.0 < 0.1.7"},{"id":"GHSA-9q4r-4842-93vw","title":"Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST \/api\/v1\/query) via unsanitized window-function name","aliases":[],"summary":"### Summary\n\nA cross-tenant SQL injection in the TSQL query compiler lets **any authenticated trigger.dev customer read every other tenant's analytics data**. The customer-facing query endpoint `POST \/api\/v1\/query` accepts a TSQL\/TRQL query that is compiled to ClickHouse SQL by `","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"trigger.dev","publishedAt":"2026-10-02T22:42:20Z","exploitedKev":false,"fixedVersion":"4.5.6","vulnerableRange":"<= 4.5.5"},{"id":"GHSA-pqxw-g93w-hj9x","title":"Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise","aliases":[],"summary":"## Summary\n\nSelf-hosted trigger.dev v4 instances deployed using the provided Docker Compose configuration with default secrets from `hosting\/docker\/.env.example` are vulnerable to a multi-stage unauthenticated attack chain leading to complete infrastructure compromise.\n\n## Vulner","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"trigger.dev","publishedAt":"2026-10-02T22:39:48Z","exploitedKev":false,"fixedVersion":"4.5.6","vulnerableRange":"<= 4.5.5"},{"id":"GHSA-62ch-8vmq-8xm7","title":"figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width","aliases":["CVE-2026-96780"],"summary":"### Impact\nA denial-of-service (infinite loop) can occur in `text()` \/ `textSync()` when\n**both**:\n- `whitespaceBreak: true` is set, **and**\n- `width` is set smaller than the rendered width of a single FIGlet character.\nUnder these conditions `breakWord()` could never find a vali","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"figlet","publishedAt":"2026-10-02T22:39:16Z","exploitedKev":false,"fixedVersion":"1.11.3","vulnerableRange":"< 1.11.3"},{"id":"GHSA-gg6r-gp4c-89hp","title":"Trigger.dev: V1 coordinator default-secret unauth Socket.IO","aliases":[],"summary":"## TL;DR\n\nThe \/coordinator Socket.IO namespace mounts on every webapp boot and authenticates with a default secret (\"coordinator-secret\") baked into source. The override variable isn't documented in the self-host docs, .env.example, or helm values, so any operator who didn't read","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"trigger.dev","publishedAt":"2026-10-02T22:39:00Z","exploitedKev":false,"fixedVersion":"4.5.4","vulnerableRange":"< 4.5.4"},{"id":"GHSA-5wf9-h793-w73c","title":"Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks","aliases":[],"summary":"### Summary\n\nPinning a CA certificate via `pinnedPeerCertSha256` can lead to the success of MITM attacks in some cases.\n\n### Details\n\nhttps:\/\/github.com\/XTLS\/Xray-core\/blob\/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e\/transport\/internet\/tls\/config.go#L333-L347\n\nIf `r.Config.ServerNam","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/xtls\/xray-core","publishedAt":"2026-10-02T22:35:51Z","exploitedKev":false,"fixedVersion":"1.260327.1-0.20260710210335-64fada32b5b9","vulnerableRange":">= 1.260113.0 < 1.260327.1-0.20260710210335-64fada32b5b9"},{"id":"GHSA-pp95-gc86-jq6q","title":"Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)","aliases":[],"summary":"### Summary\n\nThe run replay `action` function at `apps\/webapp\/app\/routes\/resources.taskruns.$runParam.replay.ts` has no authentication or authorization check. While the `loader` (GET) in the same file properly calls `requireUser(request)` and scopes queries to the user's organiza","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"trigger.dev","publishedAt":"2026-10-02T22:35:24Z","exploitedKev":false,"fixedVersion":"4.5.2","vulnerableRange":"<= 4.5.1"},{"id":"GHSA-xxv7-2vv3-h682","title":"Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL","aliases":[],"summary":"### Summary\nA project member can create a webhook alert channel whose delivery URL points at an internal address, and trigger.dev's control plane will send the alert there with no SSRF protection. The webhook URL is stored as an unvalidated string and is fetched directly from the","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"trigger.dev","publishedAt":"2026-10-02T19:31:33Z","exploitedKev":false,"fixedVersion":"4.5.2","vulnerableRange":"< 4.5.2"},{"id":"GHSA-qxpp-qjg8-x4jv","title":"Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)","aliases":[],"summary":"### Summary\nThe dashboard replay action authorizes the source run (it must belong to the caller's org), but the target environment for the replayed run is taken verbatim from the request body and is never checked for org or project membership. The environment lookup used by the r","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"trigger.dev","publishedAt":"2026-10-02T19:31:17Z","exploitedKev":false,"fixedVersion":"4.5.2","vulnerableRange":"< 4.5.2"},{"id":"GHSA-8mcx-5rqc-vhmf","title":"Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths","aliases":[],"summary":"### Affected files\n* `dulwich\/index.py` (Methods: `validate_path_element_ntfs`, `_tree_to_fs_path`)\n* `dulwich\/porcelain\/__init__.py` (Method: `_checked_worktree_path`)\n\n### Description \/ Summary\nA High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"dulwich","publishedAt":"2026-10-02T19:14:21Z","exploitedKev":false,"fixedVersion":"1.2.9","vulnerableRange":"< 1.2.9"},{"id":"GHSA-8w8g-wq8h-fq33","title":"Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections","aliases":[],"summary":"## Summary\n\nDulwich's `porcelain.checkout(paths=[...])` code path writes files using raw `os.open(file_path, O_WRONLY|O_CREAT|O_TRUNC, mode)` followed by `f.write(obj.data)`. This code path does NOT call `build_file_from_blob()` at all, completely bypassing any symlink protection","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"dulwich","publishedAt":"2026-10-02T18:53:35Z","exploitedKev":false,"fixedVersion":"1.2.8","vulnerableRange":">= 0.24.0 <= 1.2.7"},{"id":"GHSA-5fqc-mrg8-w798","title":"Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence","aliases":[],"summary":"## Summary\n\nDulwich's `filter_branch.py` `CommitFilter._apply_index_filter()` is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries (including symlinks) persist in the working directory between commits, allowing a symlink from an ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"dulwich","publishedAt":"2026-10-02T18:53:05Z","exploitedKev":false,"fixedVersion":"1.2.8","vulnerableRange":">= 0.23.1 <= 1.2.7"},{"id":"GHSA-cm62-gvxx-vmxx","title":"Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks","aliases":[],"summary":"## Summary\n\nDulwich's `stash.py:pop()` function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository.\n\n## Root Cause\n\nThe `pop()` function at `dulwich\/stash","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"dulwich","publishedAt":"2026-10-02T18:52:53Z","exploitedKev":false,"fixedVersion":"1.2.8","vulnerableRange":">= 0.22.5 <= 1.2.7"},{"id":"GHSA-qqw9-2vj9-hx7r","title":"Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-w584-2h2r-2hvf. This link is maintained to preserve external references.\n\n## Original Description\nlangflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langflow","publishedAt":"2026-10-02T00:31:30Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 1.7.2 < 1.10.1"},{"id":"GHSA-mrhx-c7xc-m3w5","title":"Zod can exhaust memory while validating oversized constrained collections","aliases":["CVE-2023-54404"],"summary":"Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayRe","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"zod","publishedAt":"2026-10-01T18:32:46Z","exploitedKev":false,"fixedVersion":"4.6.6","vulnerableRange":"< 4.6.6"},{"id":"GHSA-9cqf-hhrq-7v45","title":"SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route","aliases":[],"summary":"### Scope note\n\nThis endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit `9b8e8956f` on 2026-07-27 and is present on the current development head. No released stable version is affected.\n\n### Summary\n\n`\/api\/av\/getAttributeViewSear","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-10-01T16:24:38Z","exploitedKev":false,"fixedVersion":"0.0.0-20260812083335-251596fc0de2","vulnerableRange":">= 0.0.0-20260726161145-9b8e8956f997 < 0.0.0-20260812083335-251596fc0de2"},{"id":"GHSA-qhwx-74w5-xhxq","title":"vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape","aliases":["CVE-2026-92948"],"summary":"## Summary\n\nOn Node.js 24 and newer, `vm2` can expose the host `node:test` module to sandboxed `NodeVM` code when the embedder explicitly allows the `node:test` builtin. Sandbox code can reach that module through `require('node:node:test')` and call `run()` with attacker-controll","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-01T15:41:31Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":">= 3.9.6 <= 3.11.6"},{"id":"GHSA-jxxv-8r27-vm4p","title":"vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts","aliases":["CVE-2026-92950"],"summary":"### Summary\nThe `vm2` command-line tool installed by `npm install -g vm2` and documented in the README's \"CLI\" section runs the supplied script under `NodeVM` with `require:{external:true}` and no `root` \/ `context` \/ `builtin` configured. With these defaults the resolver loads e","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-01T15:40:45Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":"<= 3.11.6"},{"id":"GHSA-h85j-hv3c-qfgq","title":"vm2 exposes host HTTPS credentials and TLS traffic through globalAgent","aliases":["CVE-2026-92940"],"summary":"Summary\n\nvm2 3.11.6 exposes the host process's real `https.globalAgent` when a `NodeVM` is explicitly allowed to require `https`. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a `free` listener","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-01T15:38:26Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":">= 3.11.3 <= 3.11.6"},{"id":"GHSA-c48m-32m9-vx93","title":"vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package","aliases":["CVE-2026-92951"],"summary":"### Summary\n\nvm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages.\n\nWhen `NodeVM` enables an `external` allowlist together with a custom `resolve` callback, vm2 ch","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-01T15:37:19Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":"<= 3.11.6"},{"id":"GHSA-6rh5-qq4q-97xh","title":"vm2: NodeVM builtin denylist bypass via fs\/promises despite -fs, allowing host filesystem writes","aliases":["CVE-2026-92958"],"summary":"## Summary\n\nNodeVM's builtin wildcard policy can allow sandboxed code to access `fs\/promises` even when the embedder denies `fs`.\n\nWith the following configuration:\n\n```js\nrequire: {\n  builtin: ['*', '-fs', '-child_process']\n}\n```\n\n`require('fs')` and `require('child_process')` a","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-01T15:36:48Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":"<= 3.11.6"},{"id":"GHSA-8686-vhfx-7r3j","title":"vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process","aliases":["CVE-2026-92957"],"summary":"## Summary\n\nNodeVM normalizes `node:`-prefixed builtin specifiers during `require()` resolution, but it does not normalize user-provided negative builtin entries in wildcard policy.\n\nAs a result, this configuration:\n\n```js\nnew NodeVM({\n  require: {\n    builtin: ['*', '-node:child","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-01T15:36:01Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":"<= 3.11.6"},{"id":"GHSA-8hr7-r645-pc6w","title":"vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE","aliases":["CVE-2026-92935"],"summary":"## Summary\n\nThe `NodeVM` constructor computes `hasRealRequireConfig` using `typeof requireOpts === 'object' && requireOpts !== null`, so `require: []` bypasses the guard intended to reject `nesting` without an explicit require configuration. `makeResolverFromLegacyOptions()` then","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-01T15:34:58Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":">= 3.11.4 <= 3.11.6"},{"id":"GHSA-647f-g98j-qq25","title":"vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call\/apply indirection","aliases":["CVE-2026-92937"],"summary":"## Summary\n\nUntrusted JavaScript run by vm2 can escape the sandbox and execute arbitrary commands in the host Node.js process when an embedder-exposed host Promise rejects. This is an incomplete fix for GHSA-m283-3h24-438v: the advisory's capability-bearing rejection rebuild runs","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-01T15:32:10Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":"= 3.11.6"},{"id":"GHSA-6w8r-xxw2-g3hx","title":"vm2 allows a sandboxed plugin to execute native code through `node:sqlite`","aliases":["CVE-2026-92938"],"summary":"### Summary\n\nvm2 3.11.6 exposes Node.js's host `node:sqlite` module to `NodeVM` code when that builtin is allowed explicitly or through `builtin: ['*']`. The module is wrapped as read-only, but callable methods retain host-process authority. A sandboxed plugin can construct an in","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-01T15:29:04Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":">= 3.11.3 <= 3.11.6"},{"id":"GHSA-46pr-c5wc-xffx","title":"vm2 crypto builtin loads attacker native code through setEngine","aliases":["CVE-2026-92939"],"summary":"Summary\n\nvm2 3.11.6 exposes the host `crypto` module to a `NodeVM` when that single builtin is allowed. The module is presented through a read-only bridge, but its functions still execute with host-process authority. `crypto.setEngine()` accepts a filesystem path and asks OpenSSL","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-01T15:28:36Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":">= 3.11.3 <= 3.11.6"},{"id":"GHSA-27g9-p43v-cw3v","title":"vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector","aliases":["CVE-2026-92944"],"summary":"## Reporter\n\n- Name or handle: `[YMsora]`\n- Report date: 2026-08-14\n\n## Summary\n\nThe latest published vm2 release, **3.11.5**, and the current `main` branch are vulnerable to a sandbox escape when used on Node.js 26. An ordinary fulfilled Promise created by an async function can ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-01T15:28:07Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":">= 3.10.2 <= 3.11.6"},{"id":"GHSA-98xx-8mx4-x7cm","title":"vm2 NodeVM can replace the host process TLS trust store","aliases":["CVE-2026-92941"],"summary":"Summary\n\nvm2 3.11.6 exposes the host `tls` module to a `NodeVM` when that builtin is explicitly allowed. Although the module object is wrapped as read-only, its functions still execute against process-wide host state. On Node.js versions that provide `tls.setDefaultCACertificates","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-10-01T15:27:28Z","exploitedKev":false,"fixedVersion":"3.11.7","vulnerableRange":">= 3.11.3 <= 3.11.6"},{"id":"GHSA-6966-vjj6-99xv","title":"JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard","aliases":["CVE-2026-102831"],"summary":"## Description\n\nJupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing `metadata.trusted`, so a payload can declare its own output as trusted. JupyterLab does not san","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"jupyterlab","publishedAt":"2026-10-01T15:20:41Z","exploitedKev":false,"fixedVersion":"4.6.4","vulnerableRange":">= 4.6.0 <= 4.6.3"},{"id":"GHSA-j22f-vq7h-c4qm","title":"devalue: `stringify`\/`uneval` serialize shared memory","aliases":["CVE-2026-92708"],"summary":"### Impact\n\n`stringify` and `uneval` serialize a typed array by emitting its backing `ArrayBuffer`, not just the view. In the case of a Node `Buffer` object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"devalue","publishedAt":"2026-10-01T15:18:06Z","exploitedKev":false,"fixedVersion":"5.9.3","vulnerableRange":">= 5.1.0 <= 5.9.2"},{"id":"GHSA-mcm9-63f2-9j32","title":"devalue: Repeated primitive strings cause quadratic expansion in uneval","aliases":[],"summary":"Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into a very large serialized string.","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"devalue","publishedAt":"2026-10-01T15:17:29Z","exploitedKev":false,"fixedVersion":"5.9.3","vulnerableRange":"<= 5.9.2"},{"id":"GHSA-r9w8-h9r3-54w4","title":"devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation","aliases":[],"summary":"Under very specific circumstances, `parse` could create massive ArrayBuffers with very small input. This required a malformed `ArrayBuffer` custom reviver.","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"devalue","publishedAt":"2026-10-01T15:15:56Z","exploitedKev":false,"fixedVersion":"5.9.3","vulnerableRange":"<= 5.9.2"},{"id":"GHSA-x5rw-q4pp-hg5g","title":"devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise","aliases":[],"summary":"When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned `stringifyAsync` promise. Under Node's default unhandled-rejection behavior this can terminate the ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"devalue","publishedAt":"2026-10-01T15:15:13Z","exploitedKev":false,"fixedVersion":"5.9.3","vulnerableRange":">= 5.8.0 <= 5.9.2"},{"id":"GHSA-p58f-9548-mpm2","title":"virtualenv bash and fish activation scripts execute commands embedded in paths","aliases":["CVE-2026-102925"],"summary":"### Impact\n\nThe generated `activate` (bash\/zsh) and `activate.fish` scripts interpolate a `shlex.quote`-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing sh","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"virtualenv","publishedAt":"2026-10-01T15:09:17Z","exploitedKev":false,"fixedVersion":"21.7.13","vulnerableRange":"<= 21.7.12"},{"id":"GHSA-x78j-v8h9-3j2q","title":"virtualenv: Command injection via --prompt in activate.bat (batch activator)","aliases":["CVE-2026-102937"],"summary":"`BatchActivator.quote()` returned its input unchanged, the only activator with no escaping at all. `--prompt`, the `VIRTUALENV_PROMPT` environment variable, and the config file all set the prompt, and `activate.bat` writes it straight into `@set \"VAR=value\"`. A prompt containing ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"virtualenv","publishedAt":"2026-10-01T15:08:29Z","exploitedKev":false,"fixedVersion":"21.7.12","vulnerableRange":"<= 21.7.11"},{"id":"GHSA-v247-6f48-mgcj","title":"pypdf: Possible long runtimes with large amount of embedded files","aliases":["CVE-2026-102999"],"summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API.\n\n### Patches\n\nThis has been fixed in [pypdf==6.19.0](https:\/\/github.com\/py-pdf\/pypdf\/releases\/tag\/6.19.0)","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pypdf","publishedAt":"2026-10-01T15:07:35Z","exploitedKev":false,"fixedVersion":"6.19.0","vulnerableRange":"< 6.19.0"},{"id":"GHSA-php9-fj8v-98fj","title":"pypdf: Possible long runtimes when generating appearance streams","aliases":["CVE-2026-102998"],"summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation.\n\n### Patches\n\nThis has been fixed in [pypdf==6.19.0](https:\/\/github.com","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pypdf","publishedAt":"2026-10-01T15:07:21Z","exploitedKev":false,"fixedVersion":"6.19.0","vulnerableRange":"< 6.19.0"},{"id":"GHSA-w23x-9jrw-r45c","title":"pypdf: Possible large memory usage when retrieving alphabetical page labels","aliases":["CVE-2026-103000"],"summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large alphabetical labels.\n\n### Patches\n\nThis has been fixed in [pypdf==6.19.0](https:\/\/github.com\/py-pdf\/pypdf\/","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pypdf","publishedAt":"2026-10-01T15:07:08Z","exploitedKev":false,"fixedVersion":"6.19.0","vulnerableRange":"< 6.19.0"},{"id":"GHSA-jw7q-gvrg-4vj3","title":"pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)","aliases":["CVE-2026-102997"],"summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a partially malformed `\/FlateDecode` stream, where the byte-by-byte decompression is used.\n\n### Patches\n\nThis has been fixed in [pypdf==6.18.1](https:\/\/github.com\/py-pd","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pypdf","publishedAt":"2026-10-01T15:06:33Z","exploitedKev":false,"fixedVersion":"6.18.1","vulnerableRange":"< 6.18.1"},{"id":"GHSA-g9cg-prrw-2r8q","title":"pypdf: Possible large memory usage when parsing font data","aliases":["CVE-2026-102996"],"summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the `\/Widths` entry of a TrueType or Type1 fonts with unusually large values, for example during text extraction.\n\n### Patches\n\nThis has been fixed i","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pypdf","publishedAt":"2026-10-01T15:06:13Z","exploitedKev":false,"fixedVersion":"6.18.1","vulnerableRange":"< 6.18.1"},{"id":"GHSA-fp3h-c4fm-7vvf","title":"pypdf: Possible large memory usage for large \/ToUnicode streams (Follow-up 2)","aliases":["CVE-2026-102995"],"summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the `\/ToUnicode` entry of a font with unusually large values, for example during text extraction.\n\n### Patches\n\nThis has been fixed in [pypdf==6.18.1","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pypdf","publishedAt":"2026-10-01T15:06:04Z","exploitedKev":false,"fixedVersion":"6.18.1","vulnerableRange":"< 6.18.1"},{"id":"GHSA-5jq2-8x83-x246","title":"pypdf: Possible long runtimes\/large memory usage when parsing indirect objects","aliases":["CVE-2026-102994"],"summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires reading a PDF document with long indirect object headers, not terminated by whitespace.\n\n### Patches\n\nThis has been fixed in [pypdf==6.18.0](https:\/\/github.com\/py-pdf\/p","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pypdf","publishedAt":"2026-10-01T15:05:53Z","exploitedKev":false,"fixedVersion":"6.18.0","vulnerableRange":"< 6.18.0"},{"id":"GHSA-qv6h-rv94-w285","title":"pypdf: Possible large memory usage when retrieving Roman page labels","aliases":["CVE-2026-102993"],"summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large Roman numerals.\n\n### Patches\n\nThis has been fixed in [pypdf==6.17.0](https:\/\/github.com\/py-pdf\/pypdf\/relea","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pypdf","publishedAt":"2026-10-01T15:03:45Z","exploitedKev":false,"fixedVersion":"6.17.0","vulnerableRange":"< 6.17.0"},{"id":"GHSA-67c8-pqhq-4rmx","title":"piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv \/ loadBalancer \/ env","aliases":["CVE-2026-102992"],"summary":"### Summary\n\nA prototype-pollution gadget in `ThreadPool.options` allows an attacker who can pollute `Object.prototype` to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root c","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"piscina","publishedAt":"2026-10-01T15:03:33Z","exploitedKev":false,"fixedVersion":"5.3.2","vulnerableRange":">= 5.0.0 < 5.3.2"},{"id":"GHSA-c475-qrg2-pj4r","title":"basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)","aliases":["CVE-2026-102990"],"summary":"## Summary\n\n`Client.list()` parses the server's directory listing with the Unix-style parser in `parseListUnix.js`. Its `RE_LINE` regex has two adjacent `(\\S+(?:\\s\\S+)*)` groups (owner name, then group name) followed by a required numeric size group. When a line starts with a val","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"basic-ftp","publishedAt":"2026-10-01T14:42:42Z","exploitedKev":false,"fixedVersion":"6.2.1","vulnerableRange":"<= 6.2.0"},{"id":"GHSA-33jq-p8c2-q3q4","title":"SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read\/write with statement stacking","aliases":["CVE-2026-69085"],"summary":"### Summary\n\nThe `\/api\/filetree\/searchDocs` endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by `CheckAuth` only reachable by the publish RoleReader token, and by the anonymous ","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-10-01T14:38:48Z","exploitedKev":false,"fixedVersion":"0.0.0-20260721043339-eef10568384e","vulnerableRange":"< 0.0.0-20260721043339-eef10568384e"},{"id":"GHSA-wj4w-mc24-pcfm","title":"Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-qrh6-cwg3-343x. This link is maintained to preserve external references.\n\n## Original Description\nGhost, an open-source publishing platform, contains an input validation flaw in its comment ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ghost","publishedAt":"2026-10-01T12:31:19Z","exploitedKev":false,"fixedVersion":"6.44.1","vulnerableRange":">= 5.9.0 < 6.44.1"},{"id":"GHSA-94p9-xgh2-xp45","title":"virtualenv: Downloaded seed wheels (pip\/setuptools) are not integrity-checked before use","aliases":["CVE-2026-102930"],"summary":"`download_wheel()` runs `pip download` and hands the result straight to the seeder, with nothing checking the bytes it gets back. The embedded pip and setuptools wheels carry a `BUNDLE_SHA256` that virtualenv checks on every load, but a wheel fetched over the network for the peri","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"virtualenv","publishedAt":"2026-09-30T23:54:13Z","exploitedKev":false,"fixedVersion":"21.7.12","vulnerableRange":"<= 21.7.11"},{"id":"GHSA-chx6-46f5-w4vp","title":"tornado: CurlAsyncHTTPClient enforces no response-size limit \u2014 decompression bomb drives unbounded memory accumulation to OOM","aliases":[],"summary":"An unbounded memory accumulation (decompression bomb) in `tornado.curl_httpclient.CurlAsyncHTTPClient` \u2014 the client-side sibling gap of CVE-2026-49855 \u2014 verified end-to-end on the 2026-08-15 master snapshot (`6.6.dev1`) and present unchanged in the latest release tag `v6.5.8` and","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"tornado","publishedAt":"2026-09-30T23:49:13Z","exploitedKev":false,"fixedVersion":"6.5.9","vulnerableRange":"<= 6.5.8"},{"id":"GHSA-c2m8-h5v5-343r","title":"Tornado: StaticFileHandler follows symlinks outside static root (path traversal)","aliases":[],"summary":"### Summary\nStaticFileHandler allows an unauthenticated attacker to read arbitrary files from the server's filesystem by requesting a path that resolves to a symbolic link placed inside the static root directory. Any application that serves user-uploadable content, or whose stati","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"tornado","publishedAt":"2026-09-30T23:48:55Z","exploitedKev":false,"fixedVersion":"6.5.9","vulnerableRange":"<= 6.5.8"},{"id":"GHSA-667r-xxjv-c9mm","title":"fastify vulnerable to request body replacement via an async validation result collision","aliases":["CVE-2026-84504"],"summary":"### Impact\n\nFastify runs a route's validator and, for a result shaped like `{ value, error }`, unwraps it: an `error` becomes a validation failure and `value` replaces the request part. This convention is intended for synchronous custom compilers (for example Joi). A JSON Schema ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fastify","publishedAt":"2026-09-30T23:45:45Z","exploitedKev":false,"fixedVersion":"5.12.2","vulnerableRange":"< 5.12.2"},{"id":"GHSA-p68q-wchp-6fh7","title":"fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers","aliases":["CVE-2026-76169"],"summary":"### Impact\n\nFastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the `preHandler` declared in its `setNotFoundHandler()`. When the request method has no route in the","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fastify","publishedAt":"2026-09-30T23:45:34Z","exploitedKev":false,"fixedVersion":"5.12.2","vulnerableRange":">= 4.0.0 < 5.12.2"},{"id":"GHSA-hwr6-493r-vm6h","title":"fastify vulnerable to request validation bypass via skipped boolean false schemas","aliases":["CVE-2026-84469"],"summary":"### Impact\n\nFastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean `false` as a valid schema that rejects every instance, but because `false` is falsy, a route that set `body`, `querystring`, `p","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fastify","publishedAt":"2026-09-30T23:44:58Z","exploitedKev":false,"fixedVersion":"5.12.2","vulnerableRange":"< 5.12.2"},{"id":"GHSA-9q9j-q6p8-xq58","title":"fastify vulnerable to header validation bypass via incomplete schema case normalization","aliases":["CVE-2026-84428"],"summary":"### Impact\n\nFastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level `properties` keys and the root `required` array, and did not lowercas","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fastify","publishedAt":"2026-09-30T23:44:27Z","exploitedKev":false,"fixedVersion":"5.12.2","vulnerableRange":"< 5.12.2"},{"id":"GHSA-qh8j-hqjv-7m4x","title":"Astro: Malformed port in the Host header can crash the Node adapter","aliases":["CVE-2026-102984"],"summary":"## Summary\n\nIn the Astro Node adapter, a request whose `Host` header contains a malformed port (for example `example.com:65536` or `example.com:8080:8080`) produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@astrojs\/node","publishedAt":"2026-09-30T23:29:40Z","exploitedKev":false,"fixedVersion":"11.1.3","vulnerableRange":"<= 11.1.2"},{"id":"GHSA-g5vv-9gxw-82hx","title":"GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex \u2014 commit author\/committer field parsing","aliases":["CVE-2026-87819"],"summary":"### Summary\n\nGitPython's `Actor.name_email_regex` regular expression (`git\/util.py`, line 863)\nis vulnerable to catastrophic backtracking (ReDoS \u2014 Regular Expression Denial of\nService). When GitPython parses the `author` or `committer` header of a git commit\nobject that contains ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-09-30T23:29:14Z","exploitedKev":false,"fixedVersion":"3.1.60","vulnerableRange":"<= 3.1.59"},{"id":"GHSA-239g-whfq-7xj9","title":"GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution","aliases":["CVE-2026-87817"],"summary":"### Summary\n\n`Repo.__init__` decides which directory is the git directory by testing candidate paths in an order that\nconsiders the real `.git` **last**. Two earlier tests can be satisfied by ordinary tracked files. Git\nreserves only the literal name `.git`, so `HEAD`, `objects\/`","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-09-30T23:27:59Z","exploitedKev":false,"fixedVersion":"3.1.60","vulnerableRange":"<= 3.1.59"},{"id":"GHSA-47hw-gvq5-r2gm","title":"russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened","aliases":["CVE-2026-102823"],"summary":"### Summary\nCVE-2026-68930 was fixed by adding `Session::is_established_channel()` in `russh\/src\/server\/encrypted.rs`, which gates every channel-scoped SERVER-side message (CHANNEL_REQUEST, CHANNEL_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_WINDOW_ADJUST, CHANNEL_EXTENDED_DATA) on","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"russh","publishedAt":"2026-09-30T23:27:17Z","exploitedKev":false,"fixedVersion":"0.63.1","vulnerableRange":"<= 0.63.0"},{"id":"GHSA-ff3f-86qr-9cv3","title":"Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters","aliases":["CVE-2026-101896"],"summary":"A denial of service (DoS) vulnerability was identified in `@angular\/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8).\n\nWhen `@angular\/router` parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript obj","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@angular\/router","publishedAt":"2026-09-30T15:40:47Z","exploitedKev":false,"fixedVersion":"22.2.0","vulnerableRange":">= 22.0.0 < 22.2.0"},{"id":"GHSA-3q6v-r5mr-hxv8","title":"league\/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan","aliases":[],"summary":"## Summary\n\n`league\/commonmark`'s GitHub Flavored Markdown Table extension registers `TableStartParser` as a block-start parser. While a paragraph is the active block, the core block parser calls `TableStartParser::tryStart()` on every non-blank line. Its first action fetches the","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"league\/commonmark","publishedAt":"2026-09-30T15:36:13Z","exploitedKev":false,"fixedVersion":"2.10.2","vulnerableRange":">= 2.0.0 <= 2.10.1"},{"id":"GHSA-m9gg-hp2v-232j","title":"@grpc\/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized","aliases":["CVE-2026-101916"],"summary":"### Impact\nWhen server credentials are created with the `requireClientCertificate` option set to `false`, `getAuthContext` does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for `@grpc","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@grpc\/grpc-js","publishedAt":"2026-09-30T15:35:53Z","exploitedKev":false,"fixedVersion":"1.13.6","vulnerableRange":"< 1.13.6"},{"id":"GHSA-m8m8-qj5v-23w3","title":"Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection","aliases":["CVE-2026-101905"],"summary":"## Summary\n\nAxios' Node HTTP adapter can act as a read-side prototype-pollution gadget for Node's sensitive `createConnection` request option. The adapter creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects b","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"axios","publishedAt":"2026-09-30T15:32:51Z","exploitedKev":false,"fixedVersion":"1.20.0","vulnerableRange":">= 1.15.2 < 1.20.0"},{"id":"GHSA-r4gj-5m52-g5wh","title":"Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF","aliases":["CVE-2026-101907"],"summary":"## Summary\n\nAxios exposes `maxRedirects` to limit redirect following, and `maxRedirects: 0` is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API `redirect` mode, so the ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"axios","publishedAt":"2026-09-30T15:31:58Z","exploitedKev":false,"fixedVersion":"1.20.0","vulnerableRange":">= 1.17.0 < 1.20.0"},{"id":"GHSA-c29m-xwm3-cm6r","title":"Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)","aliases":["CVE-2026-101903"],"summary":"## Summary\n\nAxios for Node.js parses `data:` URLs in `lib\/helpers\/fromDataURI.js`. The current RFC-2397 parser uses a regular expression whose media type groups allow `\/` inside both sides of the `type\/subtype` match. A malformed `data:` URL containing many slashes and no comma f","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"axios","publishedAt":"2026-09-30T15:03:21Z","exploitedKev":false,"fixedVersion":"1.20.0","vulnerableRange":">= 1.16.1 < 1.20.0"},{"id":"GHSA-mghh-pgcx-3jjj","title":"Axios: ReDoS (O(N\u00b2)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location","aliases":["CVE-2026-101906"],"summary":"## Summary\n\nAxios `shouldBypassProxy()` normalizes hostnames with `hostname.replace(\/\\.+$\/, '')`. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"axios","publishedAt":"2026-09-30T15:03:02Z","exploitedKev":false,"fixedVersion":"1.20.0","vulnerableRange":">= 1.15.0 < 1.20.0"},{"id":"GHSA-x97p-jq2g-jp4f","title":"Axios: Prototype Pollution Gadget in axios toFormData Options","aliases":["CVE-2026-101909"],"summary":"## Summary\n\nAxios form serialization reads `visitor`, `maxDepth`, `dots`, `indexes`, `metaTokens`, and `Blob` from an internal options object without own-property guards. When `Object.prototype` has been polluted elsewhere in the same process, those inherited values can change ho","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"axios","publishedAt":"2026-09-30T15:02:45Z","exploitedKev":false,"fixedVersion":"0.34.0","vulnerableRange":">= 0.28.0 < 0.34.0"},{"id":"GHSA-3pq3-5fj3-cg6v","title":"Axios: HTTP\/2 adapter bypasses configured DNS lookup and proxy controls","aliases":["CVE-2026-101898"],"summary":"## Summary\n\nAxios for Node.js does not apply configured DNS lookup or proxy controls when a request uses `httpVersion: 2`. The HTTP\/1 adapter path wraps and forwards `config.lookup`, builds normal request options, and applies proxy routing through `setProxy()`. The HTTP\/2 path bu","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"axios","publishedAt":"2026-09-30T15:02:14Z","exploitedKev":false,"fixedVersion":"1.20.0","vulnerableRange":">= 1.13.0 < 1.20.0"},{"id":"GHSA-542g-h47m-68v8","title":"Axios: Denial of Service via Unhandled 'error' Event in HTTP\/2 ClientHttp2Session Initialization","aliases":["CVE-2026-101901"],"summary":"## Summary\n\nAxios versions with Node.js HTTP\/2 support can terminate the caller\u2019s process when a ClientHttp2Session emits an error event that is not handled by axios.\n\nThis affects applications that use the Node HTTP adapter with httpVersion: 2. A malicious, unavailable, or non-H","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"axios","publishedAt":"2026-09-30T15:01:07Z","exploitedKev":false,"fixedVersion":"1.20.0","vulnerableRange":">= 1.13.0 < 1.20.0"},{"id":"GHSA-vcvr-r3jv-pc5j","title":"Next.js: Remote Code Execution in next\/og ImageResponse","aliases":[],"summary":"## Impact\n\nThe Node.js `ImageResponse` implementation from `next\/og` is affected by an upstream vulnerability. This can lead to remote code execution.\n\nAffected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:\n\n```tsx\ni","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"next","publishedAt":"2026-09-30T14:48:30Z","exploitedKev":false,"fixedVersion":"16.3.6","vulnerableRange":">= 16.2.0 < 16.3.6"},{"id":"GHSA-vxq7-64xx-v4gw","title":"urllib3: HTTPResponse.stream()\/read_chunked() buffers an unbounded chunk-size line into memory","aliases":["CVE-2026-97689"],"summary":"## Impact\n\nurllib3's [streaming API](https:\/\/urllib3.readthedocs.io\/en\/2.7.0\/advanced-usage.html#streaming-and-i-o) is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When d","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"urllib3","publishedAt":"2026-09-30T14:46:18Z","exploitedKev":false,"fixedVersion":"2.8.0","vulnerableRange":">= 1.10.3 < 2.8.0"},{"id":"GHSA-8988-9cw3-xx77","title":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","aliases":["CVE-2026-97687"],"summary":"## Impact\n\nurllib3 supports configuring TLS independently for an HTTPS proxy and the target server.\n\n`proxy_ssl_context`, `proxy_assert_hostname`, and `proxy_assert_fingerprint` configure the TLS connection to the proxy. `ssl_context` and the other target-specific TLS parameters ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"urllib3","publishedAt":"2026-09-30T14:46:04Z","exploitedKev":false,"fixedVersion":"2.8.0","vulnerableRange":">= 1.26.0 < 2.8.0"},{"id":"GHSA-9c5c-9qcx-q35q","title":"@nestjs\/platform-fastify: Path-scoped middleware bypass via absolute-form request targets","aliases":[],"summary":"| Field | Value |\n| --- | --- |\n| Ecosystem | npm |\n| Package | `@nestjs\/platform-fastify` |\n| Affected versions | `>= 12.0.0, < 12.0.2` and `< 11.2.4` |\n| Patched versions | `12.0.2` and `11.2.4` (upgrade to `12.0.3` \/ `11.2.5`) |\n\n### Summary\n\nOn the Fastify adapter, an HTTP re","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@nestjs\/platform-fastify","publishedAt":"2026-09-30T14:41:39Z","exploitedKev":false,"fixedVersion":"11.2.4","vulnerableRange":"< 11.2.4"},{"id":"GHSA-prgh-xp8r-p3m5","title":"Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)","aliases":["CVE-2026-90776"],"summary":"### Summary\n\n`nodemailer\/lib\/addressparser` parses one shape of address in O(n^2) time. A single ~640 KB address value blocks the Node.js event loop for roughly 7 seconds. And it is reachable without auth: mailparser feeds inbound email headers straight into this parser, so one c","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nodemailer","publishedAt":"2026-09-30T14:41:01Z","exploitedKev":false,"fixedVersion":"10.0.5","vulnerableRange":">= 9.1.0 <= 10.0.4"},{"id":"GHSA-m8vh-jmq9-5rjg","title":"Nest: Remote process termination via a deeply nested microservice message pattern","aliases":["CVE-2026-102281"],"summary":"| Field | Value |\n| --- | --- |\n| Ecosystem | npm |\n| Package | `@nestjs\/microservices` |\n| Affected versions | `>= 12.0.0, < 12.0.2` and `< 11.2.4` |\n| Patched versions | `12.0.2` and `11.2.4` (upgrade to `12.0.3` \/ `11.2.5`) |\n\n### Summary\n\nA single message whose `pattern` is a","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@nestjs\/microservices","publishedAt":"2026-09-29T23:54:44Z","exploitedKev":false,"fixedVersion":"11.2.4","vulnerableRange":"< 11.2.4"},{"id":"GHSA-hrh2-vp3x-79xf","title":"@xhmikosr\/decompress: Path traversal via symlink chain","aliases":["CVE-2026-101894"],"summary":"### Impact\n\nWhen extracting an untrusted archive with the default `decompress(input, output)` API, a crafted archive containing a chain of symlink entries can make a later entry resolve **outside** the output directory. The lexical containment checks pass, but the kernel follows ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xhmikosr\/decompress","publishedAt":"2026-09-29T23:49:42Z","exploitedKev":false,"fixedVersion":"11.1.4","vulnerableRange":">= 11.0.0 <= 11.1.3"},{"id":"GHSA-qhr7-859c-m2p7","title":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","aliases":["CVE-2026-102278"],"summary":"### Summary\n\n`expand_()` recurses once per level of brace *nesting*. Deeply nested input exhausts the native stack and crashes the process.\n\nThis is distinct from CVE-2026-14257 \/ GHSA-mh99-v99m-4gvg, which made the *tail* iterative (recursion on `m.post`, driven by how many grou","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"brace-expansion","publishedAt":"2026-09-29T23:45:17Z","exploitedKev":false,"fixedVersion":"5.0.11","vulnerableRange":">= 4.0.0 < 5.0.11"},{"id":"GHSA-6j4f-fj2g-mc7p","title":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","aliases":["CVE-2026-102276"],"summary":"### Summary\n\n`parseCommaParts()` can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string.\n\nThis is the parsing-side counterpart to CVE-2026-14257 \/ GHSA-mh99-v99m-4gvg. That fix made `exp","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"brace-expansion","publishedAt":"2026-09-29T23:44:58Z","exploitedKev":false,"fixedVersion":"5.0.10","vulnerableRange":">= 4.0.0 < 5.0.10"},{"id":"GHSA-2gc4-cqfq-p2gv","title":"Socket.IO: Engine.IO Protocol Revision Mismatch DoS","aliases":["CVE-2026-102599"],"summary":"### Impact\n\nA denial-of-service vulnerability exists in Engine.IO \/ Socket.IO servers that allow transport upgrades.\n\nThe Engine.IO protocol revision is negotiated during the initial handshake and stored on the session, but a newly-created transport, including a WebSocket upgrade","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"engine.io","publishedAt":"2026-09-29T23:44:33Z","exploitedKev":false,"fixedVersion":"6.6.10","vulnerableRange":">= 6.6.0 < 6.6.10"},{"id":"GHSA-v53p-9fqp-m79j","title":"Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service","aliases":[],"summary":"### Summary\n\nWhen `addressparser` finds no address by its strict reading, it falls back to pulling one out of the free text with `\/\\s*\\b[^@\\s]+@[^\\s]+\\b\\s*\/`. That pattern backtracks quadratically: `[^@\\s]+` is retried from every offset and rescans the run to the next `@` each ti","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nodemailer","publishedAt":"2026-09-29T23:43:36Z","exploitedKev":false,"fixedVersion":"10.0.6","vulnerableRange":"<= 10.0.5"},{"id":"GHSA-9j54-fg26-wv3r","title":"PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation","aliases":["CVE-2026-102266"],"summary":"### Summary\n\nA service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from PyJWKSet, can therefore accept attacker-generated tokens as authenticated.\n\nPyJWT 2.13.0 rejects an empty HMAC key when it is supplied through the raw `str`\/`by","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PyJWT","publishedAt":"2026-09-29T23:43:19Z","exploitedKev":false,"fixedVersion":"2.14.0","vulnerableRange":">= 2.13.0 < 2.14.0"},{"id":"GHSA-ffc3-869f-jxw9","title":"PyJWT: Asymmetric-PEM detection bypass: whitespace\/line-ending-mutated public keys skip the HS\/asymmetric confusion guard","aliases":["CVE-2026-102268"],"summary":"**Prerequisites** (both conditions must hold; both are deployment properties, not attacker-controlled at request time):\n\n- The `jwt.decode` allow-list mixes an HMAC algorithm with an asymmetric one, e.g. `algorithms=[\"ES256\", \"HS256\"]` (the RFC 8725 footgun the guard exists to ba","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PyJWT","publishedAt":"2026-09-29T23:17:33Z","exploitedKev":false,"fixedVersion":"2.14.0","vulnerableRange":"<= 2.13.0"},{"id":"GHSA-w2cx-738m-mc7w","title":"PyJWT accepts public JWK containers as HMAC secrets","aliases":["CVE-2026-102273"],"summary":"### Summary\n\nPyJWT 2.13.0 contains an incomplete defense against algorithm confusion when\nan application mixes symmetric and asymmetric algorithms in one verification\npath. A public RSA, EC, or OKP JWK can be accepted as an HMAC secret when it\nis wrapped in a JWKS object, nested ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PyJWT","publishedAt":"2026-09-29T23:16:55Z","exploitedKev":false,"fixedVersion":"2.14.0","vulnerableRange":"= 2.13.0"},{"id":"GHSA-9v7f-9g4p-ffgj","title":"PyJWT: PyJWKClient follows redirects when fetching JWKS","aliases":["CVE-2026-102267"],"summary":"### Summary\n\nPyJWT 2.13.0 `PyJWKClient` followed HTTP redirects while fetching a JWKS,\nwithout validating the redirect destination. A configured trusted endpoint\ncould therefore redirect the client to a different host.\n\n### Impact\n\nWhen an application uses `PyJWKClient` with call","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PyJWT","publishedAt":"2026-09-29T23:15:00Z","exploitedKev":false,"fixedVersion":"2.14.0","vulnerableRange":"<= 2.13.0"},{"id":"GHSA-p4g4-x82p-q773","title":"PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard","aliases":["CVE-2026-102271"],"summary":"### Summary\n\n`HMACAlgorithm.prepare_key` blocks asymmetric keys from being used as HMAC secrets by searching for text markers only. It looks for `-----BEGIN` and for an `ssh-` prefix. The same key in DER form is binary ASN.1 and has neither marker, so it passes the check and is u","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pyjwt","publishedAt":"2026-09-29T23:14:33Z","exploitedKev":false,"fixedVersion":"2.14.0","vulnerableRange":">= 2.4.0 < 2.14.0"},{"id":"GHSA-r6x4-923q-g947","title":"PyJWT BOM Bypass","aliases":["CVE-2026-102272"],"summary":"## Affected Package\n\n- **Package**: PyJWT (`pyjwt` on PyPI)\n- **Repository**: https:\/\/www.google.com\/url?q=https:\/\/github.com\/jpadilla\/pyjwt&source=gmail&ust=1781794518474000&sa=E\n- **Affected version**: 2.13.0\n- **Vulnerability class**: Algorithm confusion \/ patch bypass\n\n---\n\n#","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PyJWT","publishedAt":"2026-09-29T23:14:00Z","exploitedKev":false,"fixedVersion":"2.14.0","vulnerableRange":"= 2.13.0"},{"id":"GHSA-8238-w5pm-2374","title":"adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)","aliases":[],"summary":"## Summary\n\nDenial of Service in `adm-zip`'s async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file.\n\n## Details\n\n**Affected package**: adm-zip\n**Affected versions**: at least 0.6.0 (current lat","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"adm-zip","publishedAt":"2026-09-29T23:10:09Z","exploitedKev":false,"fixedVersion":"0.6.1","vulnerableRange":"<= 0.6.0"},{"id":"GHSA-rcw4-f5rp-g42v","title":"adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0","aliases":[],"summary":"**Affected package:** adm-zip (npm)\n**Affected version:** 0.6.0\n\n## Summary\n\nThe fix shipped for CVE-2026-39244 (`methods\/inflater.js`) caps zlib's decompression output via `maxOutputLength: expectedLength`, where `expectedLength` is read directly from the ZIP entry's attacker-co","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"adm-zip","publishedAt":"2026-09-29T18:25:20Z","exploitedKev":false,"fixedVersion":"0.6.1","vulnerableRange":"<= 0.6.0"},{"id":"GHSA-j5f4-cc29-5x44","title":"adm-zip extraction preserves SUID\/SGID bits from untrusted ZIPs -> local privilege escalation","aliases":["CVE-2026-102282"],"summary":"## Summary\n\nadm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`\/`extractEntryTo()` \u2014 and it never filters the setuid\/setgid\/sticky bits out of those bit","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"adm-zip","publishedAt":"2026-09-29T18:24:57Z","exploitedKev":false,"fixedVersion":"0.6.1","vulnerableRange":"<= 0.6.0"},{"id":"GHSA-rfgv-xxqx-mfg5","title":"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol","aliases":["CVE-2026-19534"],"summary":"### Impact\n\nThe undici WebSocket client throws an uncaught `TypeError` during the opening handshake when a server's `101` response includes a `Sec-WebSocket-Protocol` header that the client never requested. The throw occurs in a `queueMicrotask` callback with no surrounding `try`","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"undici","publishedAt":"2026-09-29T18:21:33Z","exploitedKev":false,"fixedVersion":"6.28.1","vulnerableRange":">= 6.7.0 < 6.28.1"},{"id":"GHSA-w293-vg96-wgc3","title":"undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool","aliases":["CVE-2026-84961"],"summary":"### Impact\n\nundici's `BalancedPool` passes its constructor options through a JSON-based deep clone (`JSON.parse(JSON.stringify(...))`) before forwarding them to each per-upstream `Pool`. JSON cannot represent functions, so a caller-supplied `connect` or `tls` option containing a ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"undici","publishedAt":"2026-09-29T18:17:15Z","exploitedKev":false,"fixedVersion":"7.29.1","vulnerableRange":">= 7.24.1 < 7.29.1"},{"id":"GHSA-vp8m-p9jh-q5pm","title":"undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors","aliases":["CVE-2026-85152"],"summary":"## Impact\n\nWhen `interceptors.cache()` or `interceptors.deduplicate()` is used with a dispatcher that does not carry a single authoritative origin, or when a request supplies its own `origin`, undici builds the cache and deduplication keys without the actual destination origin. I","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"undici","publishedAt":"2026-09-29T18:15:13Z","exploitedKev":false,"fixedVersion":"8.10.2","vulnerableRange":">= 8.10.0 < 8.10.2"},{"id":"GHSA-6h2x-m376-mqjq","title":"joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`","aliases":["CVE-2026-92599"],"summary":"### Impact\nAny application that validates a user-supplied string with `Joi.string().isoDate()` can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits ma","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"joi","publishedAt":"2026-09-29T18:07:42Z","exploitedKev":false,"fixedVersion":"17.13.7","vulnerableRange":">= 17.2.0 < 17.13.7"},{"id":"GHSA-hq2x-r82h-9wj4","title":"Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab","aliases":["CVE-2026-102673"],"summary":"### Impact\n\nPopups opened from a sandboxed iframe through a link (for example `target=\"_blank\"` or a middle-click) did not inherit the iframe's HTML `sandbox` restrictions. Content that was meant to run sandboxed could open a popup with the embedding app's full origin, gaining ac","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"electron","publishedAt":"2026-09-29T18:05:34Z","exploitedKev":false,"fixedVersion":"41.10.4","vulnerableRange":"< 41.10.4"},{"id":"GHSA-gr2m-v5gq-v685","title":"Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions","aliases":["CVE-2026-102674"],"summary":"### Impact\n\nWindows opened from a sandboxed top-level document did not inherit that document's HTML `sandbox` restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes.\n","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"electron","publishedAt":"2026-09-29T18:05:11Z","exploitedKev":false,"fixedVersion":"41.10.6","vulnerableRange":"< 41.10.6"},{"id":"GHSA-j84w-jfhq-vhvj","title":"Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled","aliases":["CVE-2026-102675"],"summary":"### Impact\n\nResponses served through `protocol.registerFileProtocol` or `protocol.registerHttpProtocol` for a custom scheme registered with `supportFetchAPI: true` but without `corsEnabled: true` could be read cross-origin by web content. This completes the fix for CVE-2026-70604","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"electron","publishedAt":"2026-09-29T18:04:24Z","exploitedKev":false,"fixedVersion":"41.10.6","vulnerableRange":"< 41.10.6"},{"id":"GHSA-9qh4-3jw8-366w","title":"Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions","aliases":["CVE-2026-102676"],"summary":"### Impact\n\nA `<webview>` could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed.\n\nApps are only affected if they enable the `<webview>` tag and the embedder is uns","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"electron","publishedAt":"2026-09-29T18:02:18Z","exploitedKev":false,"fixedVersion":"41.10.6","vulnerableRange":"< 41.10.6"},{"id":"GHSA-qmv3-fv6v-rmhq","title":"Electron: Sandboxed preload code cache can be poisoned by a compromised renderer","aliases":["CVE-2026-102677"],"summary":"### Impact\n\nThe cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load.\n\nApps are only affected if they load untr","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"electron","publishedAt":"2026-09-29T18:02:01Z","exploitedKev":false,"fixedVersion":"42.10.0","vulnerableRange":">= 42.3.3 < 42.10.0"},{"id":"GHSA-r6hr-vr92-vv28","title":"PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()","aliases":["CVE-2026-65954"],"summary":"### Impact\n\nPHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in `PHPCSUtils\\AbstractSniffs\\AbstractArrayDeclarationSniff::getActualArrayKey()`. The vulnerable method is reached by any sniff that extends `AbstractArrayDeclarationSnif","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"phpcsstandards\/phpcsutils","publishedAt":"2026-09-29T17:57:16Z","exploitedKev":false,"fixedVersion":"1.2.3","vulnerableRange":">= 1.0.0-alpha1 < 1.2.3"},{"id":"GHSA-g84c-rxfj-3j2c","title":"webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath","aliases":["CVE-2026-76844"],"summary":"> [!IMPORTANT]\n> CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor t","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"webpack-dev-middleware","publishedAt":"2026-09-29T16:59:18Z","exploitedKev":false,"fixedVersion":"8.3.0","vulnerableRange":">= 8.0.0 < 8.3.0"},{"id":"GHSA-f67j-2jqw-jpq7","title":"Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE","aliases":["CVE-2026-101895"],"summary":"A Denial of Service (DoS) vulnerability exists in `@angular\/platform-server`'s DOM emulation parser (`domino`). When processing untrusted user input containing an incomplete DOCTYPE declaration ending with whitespace before EOF (such as `<!DOCTYPE html `), the HTML parser enters ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@angular\/platform-server","publishedAt":"2026-09-28T21:31:21Z","exploitedKev":false,"fixedVersion":"22.1.6","vulnerableRange":">= 22.0.0 < 22.1.6"},{"id":"GHSA-6m87-8wg6-hh8w","title":"Duplicate Advisory: Authlib: empty signatures validation in JWS JSON deserialization","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-6v38-4h7w-rj9h. This link is maintained to preserve external references.\n\n## Original Description\nAuthlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonW","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"authlib","publishedAt":"2026-09-28T21:31:18Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 1.9.0"},{"id":"GHSA-qw65-cvwx-89v3","title":"fast-uri vulnerable to authority injection via an unvalidated port in serialize","aliases":["CVE-2026-84292"],"summary":"### Impact\n\n`fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `fast-uri` escapes the userinfo and host components but concatenates the port verbatim, so a `port` value that is not a sequence of digits can inject authority d","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fast-uri","publishedAt":"2026-09-28T21:24:39Z","exploitedKev":false,"fixedVersion":"2.4.6","vulnerableRange":"< 2.4.6"},{"id":"GHSA-58mr-gqgx-xq4g","title":"fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority","aliases":["CVE-2026-84394"],"summary":"### Impact\n\n`fast-uri` accepts a host that contains an unbalanced or misplaced authority bracket (`[` or `]`) without reporting an error. A host that starts with `[` but does not end with `]`, such as `[@127.0.0.1`, is neither validated as an IP literal nor canonicalized as a dom","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fast-uri","publishedAt":"2026-09-28T21:23:35Z","exploitedKev":false,"fixedVersion":"2.4.6","vulnerableRange":"= 2.4.5"},{"id":"GHSA-j3r3-mxqp-r2p4","title":"Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements","aliases":["CVE-2026-88058"],"summary":"### Summary\nAn XSS vulnerability exists in `@angular\/platform-server` during server-side rendering (SSR) HTML serialization of `ProcessingInstruction` DOM nodes (`<?target data?>`, `nodeType === 7`) when nested inside fallback raw-content elements (`<noscript>`, `<iframe>`, `<noe","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@angular\/platform-server","publishedAt":"2026-09-28T20:39:26Z","exploitedKev":false,"fixedVersion":"22.1.4","vulnerableRange":">= 22.0.0 < 22.1.4"},{"id":"GHSA-456v-xq2p-r4cj","title":"code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)","aliases":[],"summary":"## `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)\n\n### Summary\n\nThe `grep_search` tool in `code-ollama` constructs a shell command string by interpolating attacker-controlled `pattern` and `path` arguments, then executes it via `child_process.exec","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"code-ollama","publishedAt":"2026-09-28T13:59:43Z","exploitedKev":false,"fixedVersion":"0.36.1","vulnerableRange":"<= 0.36.0"},{"id":"GHSA-c9wr-qm7p-p6vc","title":"Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-5h3f-q97h-ccvc. This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. W","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-27T03:31:03Z","exploitedKev":false,"fixedVersion":"3.12.2","vulnerableRange":"< 3.12.2"},{"id":"GHSA-7rr2-8fr3-fjqx","title":"Duplicate Advisory: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-2v2p-6j97-cjg9. This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-27T03:31:03Z","exploitedKev":false,"fixedVersion":"3.12.2","vulnerableRange":"< 3.12.2"},{"id":"GHSA-q986-4x7x-gx39","title":"SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests","aliases":["CVE-2026-57443"],"summary":"### Summary\n\nThe AetherBrowser API server (`scripts\/aetherbrowser\/api_server.py`) exposes the `POST \/api\/ops\/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to c","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"scbe-aethermoore","publishedAt":"2026-09-25T21:48:03Z","exploitedKev":false,"fixedVersion":"4.2.1","vulnerableRange":">= 4.0.2 < 4.2.1"},{"id":"GHSA-62mm-xwmv-crhg","title":"khoj has an unauthenticated path traversal in \/home\/ endpoint that allows file read from server filesystem","aliases":[],"summary":"### Summary\nThe `\/home\/{file_path:path}` endpoint in `web_client.py` serves static files by directly concatenating the user-supplied `file_path` with the `home_directory` constant. There is no path traversal filtering, no path normalization check, and no authentication required. ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"khoj","publishedAt":"2026-09-25T21:38:15Z","exploitedKev":false,"fixedVersion":"2.0.0-beta.25","vulnerableRange":">= 2.0.0-beta.23 < 2.0.0-beta.25"},{"id":"GHSA-9gfj-28hw-jchp","title":"Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools","aliases":["CVE-2026-86439"],"summary":"## Overview\n\nVerified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memory` tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions (`Get`, `Create`, `Update`, `Re","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"knowns","publishedAt":"2026-09-25T19:32:05Z","exploitedKev":false,"fixedVersion":"0.30.0","vulnerableRange":"<= 0.29.1"},{"id":"GHSA-29h2-jr22-frmh","title":"OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet","aliases":[],"summary":"### Impact\n\nTwo locations consume an encrypted handle returned by an untrusted external party and use it without verifying that the party is ACL-authorized on it.\n\n#### `VestingWalletConfidential`\n\nMalicious users can call `release` with a malicious token. This token could return","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@openzeppelin\/confidential-contracts","publishedAt":"2026-09-25T19:31:08Z","exploitedKev":false,"fixedVersion":"0.3.2","vulnerableRange":"< 0.3.2"},{"id":"GHSA-g7vj-c29h-3h5m","title":"FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider","aliases":["CVE-2026-92161"],"summary":"### Impact\n\nAn unauthenticated account takeover vulnerability exists in `fof\/oauth` when the Discord OAuth provider is enabled.\n\nDiscord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return t","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"fof\/oauth","publishedAt":"2026-09-25T15:55:07Z","exploitedKev":false,"fixedVersion":"1.7.4","vulnerableRange":"< 1.7.4"},{"id":"GHSA-v65j-hff3-753c","title":"Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled","aliases":["CVE-2026-57440"],"summary":"### Summary\nWith $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html\/javascript injection.","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"starcitizenwiki\/embedvideo","publishedAt":"2026-09-25T15:03:43Z","exploitedKev":false,"fixedVersion":"4.1.0","vulnerableRange":"<= 4.0.0"},{"id":"GHSA-qxg3-46rw-79j8","title":"code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute","aliases":["CVE-2026-61823"],"summary":"### Impact\nA Stored Cross-Site Scripting (XSS) vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on <iframe> elements.\n\nWhile the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"code16\/sharp","publishedAt":"2026-09-25T15:02:11Z","exploitedKev":false,"fixedVersion":"9.22.5","vulnerableRange":"< 9.22.5"},{"id":"GHSA-vj3q-vp3g-j9c8","title":"code16\/sharp has a stored XSS via data-html-content Sanitizer Bypass","aliases":["CVE-2026-61825"],"summary":"### Impact\nThe vulnerability allows an attacker to bypass the HTML sanitizer by using the `data-html-content` attribute in the content of a `SharpEditorFormField`. \n\n### Patches\nThe field must now explicitly configure `SharpFormEditorField::RAW_HTML` in the toolbar to keep this b","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"code16\/sharp","publishedAt":"2026-09-25T15:00:44Z","exploitedKev":false,"fixedVersion":"9.22.5","vulnerableRange":"< 9.22.5"},{"id":"GHSA-3c93-f73f-qc9h","title":"social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing","aliases":["CVE-2026-57178"],"summary":"### Impact\n\nThe `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted.\n\nApplications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could c","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"social-auth-core","publishedAt":"2026-09-24T19:57:22Z","exploitedKev":false,"fixedVersion":"5.0.0","vulnerableRange":"< 5.0.0"},{"id":"GHSA-r4vp-3vw6-r2x5","title":"Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)","aliases":["CVE-2026-57171"],"summary":"**At a glance**\n\n- **Actor:** attacker who controls the -o\/--output argument to trestle author {catalog,profile,ssp}-generate (e.g. via a CI pipeline that derives the output directory from repository-controlled data)\n\n- **Primitive:** attacker-controlled --output value reaches tr","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"compliance-trestle","publishedAt":"2026-09-24T19:52:34Z","exploitedKev":false,"fixedVersion":"3.12.4","vulnerableRange":"< 3.12.4"},{"id":"GHSA-mr95-65j8-9mxp","title":"Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)","aliases":["CVE-2026-57170"],"summary":"Reporter: Cavan Loughran, Celvex Group Inc.\n\nSummary\n-------\nThe fix for CVE-2026-46439 (3.12.2 \/ 4.0.3) removed the recursive re-render loop in trestle\/core\/commands\/author\/jinja.py render_template, but the custom include tags in trestle\/core\/jinja\/tags.py (MDSectionInclude, MDC","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"compliance-trestle","publishedAt":"2026-09-24T19:50:27Z","exploitedKev":false,"fixedVersion":"3.12.4","vulnerableRange":"< 3.12.4"},{"id":"GHSA-3cj3-hqcr-g934","title":"Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`\/browser` endpoint)","aliases":["CVE-2026-59723"],"summary":"### Summary\n\nThe Cline Hub dashboard server (`@cline\/cline-hub`), launched via the `cline dashboard` CLI command, accepts WebSocket connections on the `\/browser` endpoint without validating the HTTP `Origin` header. When `ROOM_SECRET` is not set\u2014the default for local (`127.0.0.1`","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"cline","publishedAt":"2026-09-24T19:48:34Z","exploitedKev":false,"fixedVersion":"3.0.30","vulnerableRange":"< 3.0.30"},{"id":"GHSA-36h5-qg4p-q2qf","title":"zbateson\/mail-mime-parser has CRLF header injection via attachment filename","aliases":["CVE-2026-61815"],"summary":"### Impact\n\nA CRLF (carriage-return \/ line-feed) header injection  affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.\n  \nAttachment filenames are interpolated into the `Content-Type` and `Content-Dis","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"zbateson\/mail-mime-parser","publishedAt":"2026-09-24T19:46:32Z","exploitedKev":false,"fixedVersion":"3.0.6","vulnerableRange":"< 3.0.6"},{"id":"GHSA-f6v3-2qmr-vfjx","title":"zbateson\/mail-mime-parser has uncontrolled resource consumption (CPU\/memory DoS) parsing untrusted MIME","aliases":["CVE-2026-61816"],"summary":"### Impact\n\nAn uncontrolled resource consumption \/ algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.\n\nThree independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does **not** bound the","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"zbateson\/mail-mime-parser","publishedAt":"2026-09-24T19:45:05Z","exploitedKev":false,"fixedVersion":"3.0.6","vulnerableRange":">= 2.0.0 < 3.0.6"},{"id":"GHSA-jmg2-rcxh-w8q3","title":"@rsdoctor\/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata","aliases":["CVE-2026-61782"],"summary":"### Summary\n\nThe default Rsdoctor report HTTP server started by `@rsdoctor\/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST \/api\/data\/key` endpoint with no authentication and wildcard CORS (`Access-Control-Allow-Origin: *`). Any network-adjacent or re","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@rsdoctor\/rspack-plugin","publishedAt":"2026-09-24T19:42:10Z","exploitedKev":false,"fixedVersion":"1.5.16","vulnerableRange":"<= 1.5.15"},{"id":"GHSA-4hq8-gpf5-8p68","title":"Podman: Malformed Image can trick podman run into leaking host environment variables into the container","aliases":["CVE-2026-57231"],"summary":"## Summary\n\nAn container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables in","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/containers\/podman\/v5","publishedAt":"2026-09-24T19:40:20Z","exploitedKev":false,"fixedVersion":"5.8.4","vulnerableRange":"< 5.8.4"},{"id":"GHSA-mwwr-p57h-56pf","title":"@bytebase\/dbhub's read-only mode does not prevent database writes","aliases":["CVE-2026-61788"],"summary":"### Summary\n \nSetting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never p","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@bytebase\/dbhub","publishedAt":"2026-09-24T19:37:59Z","exploitedKev":false,"fixedVersion":"0.22.6","vulnerableRange":"< 0.22.6"},{"id":"GHSA-fm8p-53ww-hf6w","title":"DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution","aliases":["CVE-2026-61742"],"summary":"### Summary\n\nDBHub `0.21.2` exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`.\n\nThe HTTP server attempts to protect browser-origin access by checking whether the `Origin` hostname equals t","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@bytebase\/dbhub","publishedAt":"2026-09-24T19:36:57Z","exploitedKev":false,"fixedVersion":"0.22.5","vulnerableRange":"<= 0.22.4"},{"id":"GHSA-36f9-7rg5-cpf8","title":"`@bsv\/wallet-toolbox` \/ `-client` \/ `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction","aliases":["CVE-2026-56744"],"summary":"Reported by @echennells (Eric Chennells). Migrated from public issue #191 to a private advisory.\n\n**Affected:** `@bsv\/wallet-toolbox` \/ `-client` \/ `-mobile`. Verified in `2.1.21` and `2.1.21-parity-fix.2`; the relevant code is the same at current HEAD\n\n**Summary:**\nWhen `createA","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@bsv\/wallet-toolbox","publishedAt":"2026-09-24T19:32:00Z","exploitedKev":false,"fixedVersion":"2.4.0","vulnerableRange":">= 1.1.47 < 2.4.0"},{"id":"GHSA-rw77-vq4g-x3hp","title":"phpMyFAQ has SQL Injection in `StopWords::add()` \u2014 Unescaped Stop Word Insertion","aliases":["CVE-2026-56738"],"summary":"## Summary\n\nThe `StopWords::add()` method in phpMyFAQ builds a SQL `INSERT` statement using `sprintf()` and inserts the user-supplied stop word value directly into the query string **without calling the application's database escaping function** on it. A sibling method, `StopWord","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"phpmyfaq\/phpmyfaq","publishedAt":"2026-09-24T19:30:07Z","exploitedKev":false,"fixedVersion":"4.1.6","vulnerableRange":"<= 4.1.5"},{"id":"GHSA-8gpw-xvpf-hvx5","title":"phpMyFAQ's two-factor authentication login bypasses the password factor","aliases":["CVE-2026-56737"],"summary":"### Summary\nThe public two-factor verification endpoint `POST \/check` logs a user in based **solely** on a valid\n6-digit TOTP token and a chosen `user-id`. It does **not** require \u2014 and is not bound to \u2014 a prior\nsuccessful password authentication. For any account that has 2FA ena","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"thorsten\/phpmyfaq","publishedAt":"2026-09-24T19:29:27Z","exploitedKev":false,"fixedVersion":"4.1.6","vulnerableRange":">= 3.2.0 < 4.1.6"},{"id":"GHSA-pgwp-vc7q-cvj3","title":"phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission","aliases":["CVE-2026-56736"],"summary":"### Summary\nA stored cross-site scripting (XSS) vulnerability in phpMyFAQ allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"thorsten\/phpmyfaq","publishedAt":"2026-09-24T19:28:43Z","exploitedKev":false,"fixedVersion":"4.2.0-alpha","vulnerableRange":"< 4.2.0-alpha"},{"id":"GHSA-g28h-2cmm-rj9x","title":"langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs","aliases":[],"summary":"## Summary\n\n`langchain-nvidia-ai-endpoints` versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model (VLM) requests. If an application passed attacker-controlled image input to `ChatNVIDIA` or VLM reranking APIs, an attacker could cause file","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langchain-nvidia-ai-endpoints","publishedAt":"2026-09-24T19:25:36Z","exploitedKev":false,"fixedVersion":"1.4.2","vulnerableRange":"<= 1.4.1"},{"id":"GHSA-w3rp-4cm2-4wgc","title":"ixo Blockchain x\/bonds DID-resolved payer drain + x\/entity ICA authorization bypass","aliases":["CVE-2026-61604"],"summary":"Impact\n\n  Type: Improper authorization leading to unauthorized movement of user funds.\n\n  The x\/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected hand","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/ixofoundation\/ixo-blockchain\/v8","publishedAt":"2026-09-24T19:22:53Z","exploitedKev":false,"fixedVersion":"8.0.0","vulnerableRange":"< 8.0.0"},{"id":"GHSA-g5f9-3xfg-p9mf","title":"Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context","aliases":["CVE-2026-61732"],"summary":"## Summary\n\nDecepticon wraps web crawl results \u2014 the output of agent reconnaissance against target services \u2014 into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to a","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"decepticon-core","publishedAt":"2026-09-24T19:17:49Z","exploitedKev":false,"fixedVersion":"1.1.17","vulnerableRange":"<= 1.1.16"},{"id":"GHSA-6v3r-4p5c-mrp5","title":"Language Servers for AWS vulnerable to arbitrary file write","aliases":["CVE-2026-12958"],"summary":"## Summary\nLanguage Servers for AWS (the aws\/language-servers project) provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Ecli","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@aws\/lsp-codewhisperer","publishedAt":"2026-09-24T19:15:39Z","exploitedKev":false,"fixedVersion":"0.0.117","vulnerableRange":"< 0.0.117"},{"id":"GHSA-xhcr-j4j9-3gh7","title":"Language Servers for AWS Vulnerable to Arbitrary Code Execution","aliases":["CVE-2026-12957"],"summary":"### Summary\nLanguage Servers for AWS (the aws\/language-servers project) provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and\nVisual Studio).\n\nImproper trust boundar","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@aws\/lsp-codewhisperer","publishedAt":"2026-09-24T19:13:53Z","exploitedKev":false,"fixedVersion":"0.0.113","vulnerableRange":"< 0.0.113"},{"id":"GHSA-396x-xmvh-p563","title":"Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API","aliases":["CVE-2026-63498"],"summary":"Snipe-IT's uploaded-files API accepts XML documents and later serves them inline without applying the safe-inline allowlist used by the equivalent web controller. An authenticated user who can attach files to a supported object can upload an XSLT stylesheet and an XML document th","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"snipe\/snipe-it","publishedAt":"2026-09-24T18:19:38Z","exploitedKev":false,"fixedVersion":"8.7.0","vulnerableRange":"< 8.7.0"},{"id":"GHSA-9993-rfwp-rhwf","title":"ZITADEL: MFA bypass via session reuse in Login V2","aliases":["CVE-2026-85056"],"summary":"### Summary\n\nA vulnerability in ZITADEL\u2019s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user\u2019s enrolled second factor (TOTP, OTP, or U2F). An attacker who already knows valid credentials can fully authe","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/zitadel\/zitadel","publishedAt":"2026-09-24T18:19:35Z","exploitedKev":false,"fixedVersion":"1.80.0-v2.20.0.20260717062356-56f4798ed31f","vulnerableRange":"< 1.80.0-v2.20.0.20260717062356-56f4798ed31f"},{"id":"GHSA-fgmf-7rf8-m6vf","title":"ZITADEL: Actions V1 sandbox escape: host file read via require()","aliases":["CVE-2026-85057"],"summary":"### Summary\n\nA vulnerability in ZITADEL Actions V1 allows an organization Action author to read files from the ZITADEL host filesystem through the JavaScript `require()` module loader. On common self-hosted deployments this can be chained to steal bootstrap credentials (including","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/zitadel\/zitadel","publishedAt":"2026-09-24T18:19:32Z","exploitedKev":false,"fixedVersion":"1.80.0-v2.20.0.20260717062331-baf6ed501b68","vulnerableRange":"< 1.80.0-v2.20.0.20260717062331-baf6ed501b68"},{"id":"GHSA-p9h3-gvpq-5539","title":"Snipe-IT: Stored XSS via Custom Field name in asset-list column headers","aliases":["CVE-2026-62368"],"summary":"### Impact\nA user with the \"customfields.create\" permission can store HTML\/JS in a Custom Field name, which is later rendered as an asset-list column title WITHOUT escaping at app\/Presenters\/AssetPresenter.php line 364 ('title' => $field->name) and injected into the table header ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"snipe\/snipe-it","publishedAt":"2026-09-24T18:19:30Z","exploitedKev":false,"fixedVersion":"8.7.0","vulnerableRange":"< 8.7.0"},{"id":"GHSA-hxcx-9h4f-42xx","title":"Snipe-IT: 2FA bypass via the API token flow","aliases":["CVE-2026-63493"],"summary":"### Impact\n\nAn attacker who knows a victim's password fully bypasses that account's 2FA and obtains a persistent token with full API access as the user (read and write across the user's permissions, including admin if the victim is an admin).\n\nThe token is an API credential, not ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"snipe\/snipe-it","publishedAt":"2026-09-24T16:38:27Z","exploitedKev":false,"fixedVersion":"8.7.0","vulnerableRange":"< 8.7.0"},{"id":"GHSA-6rf4-v2fh-m6p4","title":"SunEditor: Critical XSS vulnerability - sanitizer bypass","aliases":["CVE-2026-59167"],"summary":"## Summary\n\nSUNEDITOR `v2.47.10` appears to allow JavaScript execution through crafted namespaced HTML elements.\n\nThe sanitization logic does not fully remove executable event-handler attributes from certain custom\/namespaced tags. As a result, an attacker may be able to inject H","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"suneditor","publishedAt":"2026-09-24T14:57:55Z","exploitedKev":false,"fixedVersion":"2.47.11","vulnerableRange":"<= 2.47.10"},{"id":"GHSA-9643-4qgh-g8mx","title":"elysia has Inefficient Algorithmic Complexity and Interpretation Conflict","aliases":["CVE-2026-56669"],"summary":"Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code.\n\nElysia uses `getAll` to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"elysia","publishedAt":"2026-09-23T21:54:50Z","exploitedKev":false,"fixedVersion":"1.4.29","vulnerableRange":"< 1.4.29"},{"id":"GHSA-wmw4-mw6x-6vfm","title":"ReactPress has SQL injection via dynamic column names in TypeORM query builders","aliases":["CVE-2026-61685"],"summary":"## Summary\n\nReactPress API list endpoints build TypeORM `QueryBuilder` conditions using\nunsanitized HTTP query parameter *names* as SQL column identifiers\n(e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column\nnames, allowing unauthenticated attackers to injec","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@fecommunity\/reactpress","publishedAt":"2026-09-23T21:51:59Z","exploitedKev":false,"fixedVersion":"3.7.0","vulnerableRange":"<= 3.6.0"},{"id":"GHSA-gvf2-2rh5-mpgf","title":"OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget","aliases":["CVE-2026-77394"],"summary":"## Summary\nA user who can save a telemetry **screen** (permission `system_set`) can embed JavaScript in a screen `BUTTON` widget. The `BUTTON` widget **`eval()`s the stored button text in the browser** when the button is activated, and screens are **shared content rendered to oth","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@openc3\/vue-common","publishedAt":"2026-09-23T21:24:11Z","exploitedKev":false,"fixedVersion":"7.3.0","vulnerableRange":">= 5.0.6 <= 7.2.1"},{"id":"GHSA-9wh6-9hq7-9688","title":"Klever-Go: Validator registration accepts an unvalidated BLS public key \u2192 consensus liveness DoS","aliases":["CVE-2026-82407"],"summary":"**Location:** `core\/kapp\/validators\/validators.go:201` (`Register`), (`genesis\/checking\/nodesSetupChecker.go:73`). `core\/consensus\/slot\/bls\/subslotStartSlot.go:165` `core\/consensus\/...\/headerSignatureVerify.go:123` (`Create(...)`).\n\n### Description\n\nKlever uses a BDN (Boneh-Drijv","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/klever-io\/klever-go","publishedAt":"2026-09-23T21:24:08Z","exploitedKev":false,"fixedVersion":"1.7.20","vulnerableRange":"<= 1.7.19"},{"id":"GHSA-7c7c-373r-gfjj","title":"Klever-Go: Elasticsearch bulk \/ painless injection via on-chain account name -> explorer\/indexer data forgery","aliases":["CVE-2026-82409"],"summary":"**Component:** Elasticsearch indexer (`indexer\/`)\n**Primary location:** `indexer\/common.go:2395-2407` (`serializedDataForUpdateAccounts`)\n**Entry point:** `SetAccountName` native transaction (contract type 12) \u2014 `core\/process\/transaction\/txProcess.go:688`\n\n---\n\n## Description\n\nWh","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/klever-io\/klever-go","publishedAt":"2026-09-23T21:24:06Z","exploitedKev":false,"fixedVersion":"1.7.20","vulnerableRange":"<= 1.7.19"},{"id":"GHSA-26r5-4mm2-px5c","title":"Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace","aliases":["CVE-2026-82406"],"summary":"**Location:** `core\/kapp\/market\/market.go` \u2014 `Buy()` (approx. L281\u2013436)\\\n**Severity:** High\n\nThe native marketplace enforces an `IsClaimed` guard in `Claim` (`market.go:752`), `CancelOrder` (`market.go:1125`), and `orderEscrowAmount` (`market.go:251`), but **not in `Buy`**.\n\nMark","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/klever-io\/klever-go","publishedAt":"2026-09-23T21:24:03Z","exploitedKev":false,"fixedVersion":"1.7.20","vulnerableRange":"<= 1.7.19"},{"id":"GHSA-9rg8-2wvr-fgjh","title":"Formie: Missing authorization on sent notification resend modal exposes submission PII","aliases":["CVE-2026-76089"],"summary":"### Impact\n\nThe control panel action `formie\/sent-notifications\/get-resend-modal-content` (`SentNotificationsController::actionGetResendModalContent`) performed only `requireAcceptsJson()` and loaded a `SentNotification` by request `id` without permission or object-level authoriz","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"verbb\/formie","publishedAt":"2026-09-23T21:24:01Z","exploitedKev":false,"fixedVersion":"3.1.31","vulnerableRange":">= 3.0.0 < 3.1.31"},{"id":"GHSA-97cv-x867-6xhm","title":"Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller","aliases":["CVE-2026-82405"],"summary":"### Description\n\nThe VM built-in function `KleverUpdateAccountPermission` (registered always-active, `creator.go:381-390` \/ `core\/vmconstants.go:234`) rewrites an account's entire permission set. Its authorization check uses `vmInput.RecipientAddr` **attacker-controlled**  instea","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/klever-io\/klever-go","publishedAt":"2026-09-23T19:27:08Z","exploitedKev":false,"fixedVersion":"1.7.20","vulnerableRange":"<= 1.7.19"},{"id":"GHSA-4fwh-wrm6-97xm","title":"Klever-Go: Unauthenticated WebSocket \/subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory\/goroutine exhaustion (DoS)","aliases":["CVE-2026-86065"],"summary":"## Summary\nThe unauthenticated WebSocket endpoint `GET \/subscribe` is registered `open: true` by default\n(`config\/node\/api.yaml`) and lets a remote, unauthenticated client exhaust the node's memory and\ngoroutines. Because the REST API runs IN-PROCESS with the node \u2014 `network\/api\/","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/klever-io\/klever-go","publishedAt":"2026-09-23T19:16:40Z","exploitedKev":false,"fixedVersion":"1.7.20","vulnerableRange":"< 1.7.20"},{"id":"GHSA-9v8p-frvj-2pcm","title":"Klever-Go: \/log controls global node logging","aliases":["CVE-2026-86064"],"summary":"An unauthenticated client can connect to `GET \/log`, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this reposit","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/klever-io\/klever-go","publishedAt":"2026-09-23T19:13:46Z","exploitedKev":false,"fixedVersion":"1.7.20","vulnerableRange":"<= 1.7.19"},{"id":"GHSA-584p-f93j-wpgc","title":"Formie: Unauthenticated users can overwrite incomplete submissions via submit action","aliases":["CVE-2026-76087"],"summary":"### Impact\n\nThe anonymous front-end action `formie\/submissions\/submit` (`SubmissionsController::actionSubmit`) trusted a client-supplied `submissionId` when loading an incomplete submission, with no session binding, ownership check, or edit token validation.\n\nAn unauthenticated a","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"verbb\/formie","publishedAt":"2026-09-23T18:36:44Z","exploitedKev":false,"fixedVersion":"3.1.31","vulnerableRange":">= 3.0.0 < 3.1.31"},{"id":"GHSA-v3f3-cmj4-cvj9","title":"Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials","aliases":["CVE-2026-76086"],"summary":"### Impact\n\nThe control panel action `formie\/integrations\/form-settings` (`IntegrationsController::actionFormSettings`) was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"verbb\/formie","publishedAt":"2026-09-23T18:33:57Z","exploitedKev":false,"fixedVersion":"3.1.31","vulnerableRange":">= 3.0.0 < 3.1.31"},{"id":"GHSA-vmjq-hvgq-2wv4","title":"9router: Mass assignment in PATCH \/api\/settings allows authenticated authorization downgrade","aliases":["CVE-2026-56679"],"summary":"### Summary\nThe `PATCH \/api\/settings` endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here \u2014 notably `requireLogin`. Setting `requireLogin: false` ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"9router","publishedAt":"2026-09-23T18:12:33Z","exploitedKev":false,"fixedVersion":"0.5.4","vulnerableRange":"<= 0.5.2"},{"id":"GHSA-cmhj-wh2f-9cgx","title":"9router: Image prefetch DNS rebinding allows SSRF to internal services","aliases":["CVE-2026-56676"],"summary":"## Summary\n\n9router validates image URLs by resolving the host before fetching, but the later\nserver-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can\nresolve to a public IP during validation and then rebind to an internal Docker\/private IP\nduring","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"9router","publishedAt":"2026-09-23T18:12:28Z","exploitedKev":false,"fixedVersion":"0.5.2","vulnerableRange":"<= 0.4.80"},{"id":"GHSA-x5c9-v98j-722r","title":"9router \/v1 APIs has unauthenticated access via reverse proxy locality collapse","aliases":["CVE-2026-56675"],"summary":"## Summary\n\n9router treats local loopback requests as trusted and allows access to `\/v1\/*` without an\nAPI key. In a documented\/common reverse-proxy deployment where nginx forwards public\ntraffic to the backend via `127.0.0.1`, external non-`Origin` requests are misclassified as\nl","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"9router","publishedAt":"2026-09-23T18:12:26Z","exploitedKev":false,"fixedVersion":"0.5.2","vulnerableRange":"<= 0.4.80"},{"id":"GHSA-6cp7-3m3c-5x5c","title":"Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)","aliases":["CVE-2026-61652"],"summary":"### Impact\n\nDenial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size \u2014 explicit (`iter_bytes(chunk_size=...)`) or the default \u2014 to bound memory. The decoder ignored that bound, so a chunk could be far larger than req","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"zapros","publishedAt":"2026-09-23T13:57:48Z","exploitedKev":false,"fixedVersion":"0.14.0","vulnerableRange":"< 0.14.0"},{"id":"GHSA-rr49-f9g6-c9r5","title":"plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection","aliases":["CVE-2026-57149"],"summary":"### Impact\nThe Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template\/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"plone.app.portlets","publishedAt":"2026-09-23T13:55:47Z","exploitedKev":false,"fixedVersion":"7.0.2","vulnerableRange":">= 7.0.0 <= 7.0.1"},{"id":"GHSA-wx4m-69m9-gx3m","title":"Home Assistant: XSS in Statistics Graph Card","aliases":["CVE-2026-91130"],"summary":"### Summary\nAn authenticated party can add a malicious name to any statistics-capable entity, allowing for\nCross-Site Scripting attacks against anyone who views a Statistics Graph card containing that\nentity, when they hover over any data point on the chart.\n\n**Payload**\n<img wid","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"homeassistant","publishedAt":"2026-09-22T20:40:55Z","exploitedKev":false,"fixedVersion":"2026.7.0","vulnerableRange":"< 2026.7.0"},{"id":"GHSA-xj3h-wwxq-gfcj","title":"Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service","aliases":["CVE-2026-77633"],"summary":"## Summary\n\nCloudreve v4 splits the storage-quota **check** (reading the user's `used` bytes and comparing them to `MaxStorage`) and the **charge** (incrementing `users.storage`) into two non-atomic steps in the `PrepareUpload` code path. This creates a Time-of-Check to Time-of-U","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/cloudreve\/Cloudreve\/v4","publishedAt":"2026-09-22T20:40:33Z","exploitedKev":false,"fixedVersion":"4.0.0-20260715025621-7329602751c0","vulnerableRange":"< 4.0.0-20260715025621-7329602751c0"},{"id":"GHSA-vv3m-f8x4-7377","title":"lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard","aliases":["CVE-2026-85740"],"summary":"## Summary\n\nLightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, `_validated_addresses()` in `lightrag\/parser\/markdown\/parser.py`, resolves the image host and rejects it when the resolved IP is n","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lightrag-hku","publishedAt":"2026-09-22T20:40:25Z","exploitedKev":false,"fixedVersion":"1.5.5","vulnerableRange":"< 1.5.5"},{"id":"GHSA-frch-4w6v-q5xx","title":"lightrag-hku: No Rate Limiting on \/login Endpoint Allows Brute-Force Attacks","aliases":["CVE-2026-85734"],"summary":"### Summary\nThe POST \/login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed.\n\n### Details\n\n```python\n# lightrag\/api\/lightrag_server.py:2161\n@app.post(\"\/login\")\nasync def login(for","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lightrag-hku","publishedAt":"2026-09-22T20:40:22Z","exploitedKev":false,"fixedVersion":"1.5.5","vulnerableRange":"< 1.5.5"},{"id":"GHSA-vxg7-f2jj-jmqm","title":"Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability","aliases":["CVE-2026-76819"],"summary":"A vulnerability in the Goja JavaScript engine used by Nuclei's `javascript:` protocol allows arbitrary native code execution on the scanner host when running untrusted JavaScript templates.\n\n**Affected Component**\n\nThe issue is in the Goja JavaScript runtime embedded in Nuclei's ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/projectdiscovery\/nuclei\/v3","publishedAt":"2026-09-22T20:37:13Z","exploitedKev":false,"fixedVersion":"3.10.0","vulnerableRange":">= 3.0.0 < 3.10.0"},{"id":"GHSA-328g-jx67-v94g","title":"Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for","aliases":["CVE-2026-77560"],"summary":"# tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for\n\n\n\n## GitHub Advisory Details (form fields \u2014 paste-ready)\n\n**Affected products**\n| Field | Value |\n","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/tinyauthapp\/tinyauth","publishedAt":"2026-09-22T20:37:08Z","exploitedKev":false,"fixedVersion":"1.0.1-0.20260720133915-80bc87188ec3","vulnerableRange":"< 1.0.1-0.20260720133915-80bc87188ec3"},{"id":"GHSA-5jpj-293f-rhvj","title":"KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API","aliases":["CVE-2026-62371"],"summary":"## Impact\n\nThe KubeEdge NodeUpgradeJob handler constructed the `keadm upgrade edge` command by concatenating the user-controlled `spec.version` and `spec.image` fields into a shell command.\n\nAn authenticated user with permission to create or update `NodeUpgradeJob` resources thro","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/kubeedge\/kubeedge","publishedAt":"2026-09-22T20:37:04Z","exploitedKev":false,"fixedVersion":"1.21.2","vulnerableRange":">= 1.12.0 < 1.21.2"},{"id":"GHSA-9vm9-pqxx-x83v","title":"KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join","aliases":["CVE-2026-62369"],"summary":"## Description\n\nKubeEdge `keadm` contains a path traversal vulnerability in the `DecompressTarGz` archive extraction function.\n\nArchive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-direc","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/kubeedge\/kubeedge","publishedAt":"2026-09-22T20:36:59Z","exploitedKev":false,"fixedVersion":"1.21.2","vulnerableRange":">= 1.16.0 < 1.21.2"},{"id":"GHSA-34fc-gh42-pj53","title":"OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack","aliases":["CVE-2026-63132"],"summary":"### Impact\n\nWhen running in the highly privileged recovery mode, OpenBao was vulnerable to a timing attack against the single recovery token. This allowed an attacker to extract the recovery token and use it to perform operations against the OpenBao instance, including reading or","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/openbao\/openbao","publishedAt":"2026-09-22T20:36:51Z","exploitedKev":false,"fixedVersion":"0.0.0-20260713141742-763625a20721","vulnerableRange":"< 0.0.0-20260713141742-763625a20721"},{"id":"GHSA-59w7-v8rr-pr4p","title":" OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters","aliases":["CVE-2026-71543"],"summary":"## Impact\n\n### ACL Policies\n\nOpenBao supports \"templated polices\": Policies with placeholders that are replaced at evaluation time.\n\nThis allows you to write a single policy which e.g. grants user \"alice\" access to all entries in a key value engine prefixed with `alice\/` while gr","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/openbao\/openbao","publishedAt":"2026-09-22T20:36:49Z","exploitedKev":false,"fixedVersion":"0.0.0-20260710001938-2d4ebafec5c5","vulnerableRange":"< 0.0.0-20260710001938-2d4ebafec5c5"},{"id":"GHSA-m3c6-2p7h-cfr3","title":"KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes","aliases":["CVE-2026-62182"],"summary":"## Description\n\nKubeEdge ConfigUpdateJob processing was vulnerable to command injection on edge nodes.\n\nThe `updateFields` values from a ConfigUpdateJob were concatenated into a command string and executed through a system shell. An authenticated user with sufficient permissions ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/kubeedge\/kubeedge","publishedAt":"2026-09-22T20:36:44Z","exploitedKev":false,"fixedVersion":"1.21.2","vulnerableRange":">= 1.21.0 < 1.21.2"},{"id":"GHSA-72h8-wp98-7hch","title":"Unleash: Missing await on permission check + cross-project IDOR in admin API","aliases":["CVE-2026-77426"],"summary":"## Summary\n\nMultiple authorization vulnerabilities in Unleash admin API, including a critical missing `await` that completely bypasses a permission check.\n\n## Vulnerability 1: Missing `await` on Permission Check (HIGH)\n\n**File:** `src\/lib\/features\/segment\/segment-controller.ts` (","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"unleash-server","publishedAt":"2026-09-22T20:36:42Z","exploitedKev":false,"fixedVersion":"8.0.3","vulnerableRange":"< 8.0.3"},{"id":"GHSA-93xw-j965-9mx3","title":"MCP Atlassian: Arbitrary file read\/exfiltration via upload_attachment missing validate_safe_path()","aliases":["CVE-2026-77258"],"summary":"## Summary\n\nThe `upload_attachment` method in `confluence\/attachments.py` reads and uploads arbitrary local files to Confluence without calling `validate_safe_path()`. Both download methods (`download_attachment` at line 223, `download_content_attachments` at line 272) correctly ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:36:37Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-f6pj-qv47-g96w","title":"MCP Atlassian: Arbitrary server-local file upload to Jira\/Confluence attachments via unrestricted file_path parameters","aliases":["CVE-2026-77247"],"summary":"## Summary\n\nThe Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment.\n\nIn local `stdio` deployments, this can expose files readabl","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:36:29Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-wrhw-j3f9-8vc6","title":"[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token","aliases":["CVE-2026-77244"],"summary":"**Description**\n\nmcp-atlassian deploys in two common patterns:\n\n  Pattern A (single-user, server-side credentials): operator sets\n    JIRA_USERNAME + JIRA_API_TOKEN (or CONFLUENCE_USERNAME + CONFLUENCE_API_TOKEN)\n    in environment variables. Server uses these to call Jira\/Conflu","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:36:26Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-hgcf-4mq8-5266","title":"MCP Atlassian: SSRF Protection Bypass","aliases":["CVE-2026-77274"],"summary":"## Environment\n\n- Project: `sooperset\/mcp-atlassian`\n- Affected function: `validate_url_for_ssrf()`\n- Affected path: header-based Jira\/Confluence URL authentication flow\n- Tested endpoint: `POST \/mcp`\n- Tested version: `2.14.5`\n\n## Description\n\nThe SSRF protection in `validate_ur","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:36:22Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-6vmq-24h2-pj7j","title":"MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)","aliases":["CVE-2026-77271"],"summary":"### Summary\n\nThe path traversal fix introduced in v0.17.0 (GHSA-xjgw-4wvw-rgm4) is incomplete. `validate_safe_path()` is called without an explicit `base_dir`, defaulting to `os.getcwd()`. In standard container deployments the process CWD is the application directory (e.g. `\/app`","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:36:20Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-5wf4-jqxh-8gm3","title":"mcp-atlassian has an incomplete SSRF remediation","aliases":["CVE-2026-77267"],"summary":"### Summary\n\nThe `UserTokenMiddleware` extracts URLs from `X-Atlassian-Jira-Url` and `X-Atlassian-Confluence-Url` HTTP headers and passes them directly to API client constructors without any SSRF validation.\n\n### Affected Package\n\n- **Ecosystem:** PyPI\n- **Package:** mcp-atlassia","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:36:17Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-p6hp-93wp-fh6p","title":"MCP Atlassian: Path Traversal \/ Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)","aliases":["CVE-2026-77262"],"summary":"## Summary\n\n`mcp-atlassian` exposes an MCP tool `confluence_upload_attachment` whose `file_path` argument is passed directly to `open(file_path, \"rb\")` without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exf","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:35:21Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-6cr4-ccf3-x7h4","title":"MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials","aliases":["CVE-2026-77259"],"summary":"### Summary\n\nMissing path validation in `confluence_upload_attachment` allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, `\/proc\/self\/environ` yields all runtime secrets in a si","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:35:16Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-6529-c226-h328","title":"MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches","aliases":["CVE-2026-77261"],"summary":"### Summary\n\n`_make_ssrf_safe_hook()` blocks HTTP redirects to private\/internal IPs by validating the `Location` header before the client follows a `3xx` response. The problem is that this hook is only attached in one of three authentication branches \u2014 the header-PAT path. Basic ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:35:13Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-f4p7-qx46-wc5j","title":"MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)","aliases":["CVE-2026-77260"],"summary":"## Summary\n\nThis is an arbitrary local file READ vulnerability on the Confluence and Jira `upload_attachment` tool paths. It's the symmetric counterpart of the file-write vulnerability you patched as CVE-2026-27825. The write direction was fixed; the read direction was left open.","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:35:00Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-mrq8-fv7v-hhjg","title":"MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths","aliases":["CVE-2026-77257"],"summary":"# sooperset\/mcp-atlassian: HTTP upload tools can attach arbitrary server-local files\n\nDate: 2026-05-05\nTarget: `sooperset\/mcp-atlassian`\nCommit: `d8bc78698a63cb6b321c7ca796d6329d448f7f6d`\n\n## Summary\n\n`mcp-atlassian` supports HTTP\/SSE deployment for persistent, remote, and multi-","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:34:58Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-3r68-hf9h-887v","title":"MCP Atlassian: ENABLED_TOOLS \/ Toolset authorization bypass","aliases":["CVE-2026-77243"],"summary":"### Summary\n\n`ENABLED_TOOLS` and `TOOLSETS` filters are enforced at `tools\/list` time only. `tools\/call` dispatches from the full unfiltered tool registry (73 tools). Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not sec","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:34:55Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-2xj6-xx86-cwwc","title":"MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue","aliases":["CVE-2026-77255"],"summary":"### Summary\nA critical Confused Deputy (Arbitrary File Read & Exfiltration) vulnerability in the Atlassian MCP server (Python) allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the upd","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:34:52Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-vc25-24vv-fxxm","title":"MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files","aliases":["CVE-2026-77253"],"summary":"### Summary\n\nMCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any fi","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:34:50Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-w66g-j6c4-hcfc","title":"MCP Atlassian: JIRA_PROJECTS_FILTER \/ CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)","aliases":["CVE-2026-77251"],"summary":"### Summary\n\n`mcp-atlassian` is a popular community MCP server wrapper exposing Jira \/ Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects\/spaces via the `JIRA_PROJECTS_FILTER` and `CONFLUENCE_SPACES_FILTER` environment variables, w","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:34:47Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-wv8v-v4c5-v75j","title":"MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path","aliases":["CVE-2026-77246"],"summary":"### Summary\n\nThe `mcp-atlassian` server exposes an MCP tool (`confluence_upload_attachment` and the Jira attachment variant) that accepts an arbitrary server-side file path and opens it for upload without any path validation. When the server is deployed in HTTP transport mode (`s","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:34:45Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-cc5h-2pwp-pvcc","title":"MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport","aliases":["CVE-2026-77248"],"summary":"### Summary\nIn the documented multi-user HTTP deployment (`--transport streamable-http` with global operator Atlassian credentials), sooperset\/mcp-atlassian exposes all tools to **unauthenticated network clients**, and the `upload_attachment` tool reads an attacker-supplied `file","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-atlassian","publishedAt":"2026-09-22T20:34:43Z","exploitedKev":false,"fixedVersion":"0.22.0","vulnerableRange":"< 0.22.0"},{"id":"GHSA-8h6x-h86x-75wh","title":"SIPGO: DoS via unvalidated WebSocket frame length","aliases":["CVE-2026-77322"],"summary":"### Summary\n\nThe WebSocket transport allocates a buffer from the frame payload length before validating its size, which can lead to an unauthenticated DoS.\n\n### Details\n\n`WSConnection.Read` allocates a buffer from the declared WebSocket frame length before reading the payload (ht","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/emiago\/sipgo","publishedAt":"2026-09-22T20:34:30Z","exploitedKev":false,"fixedVersion":"1.4.3","vulnerableRange":"<= 1.4.2"},{"id":"GHSA-5vvx-3h34-f3gj","title":"MPXJ: XXE Vulnerability in MerlinReader","aliases":["CVE-2026-61570"],"summary":"### Impact\nMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to rea","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mpxj","publishedAt":"2026-09-22T20:34:25Z","exploitedKev":false,"fixedVersion":"16.4.1","vulnerableRange":">= 5.5.5 < 16.4.1"},{"id":"GHSA-pg59-5vwg-4jxq","title":"SIPGO: DoS via unvalidated Content-Length in the stream parser","aliases":["CVE-2026-58268"],"summary":"### Summary\n\nThe stream parser allocates the SIP body buffer from the `Content-Length` header before validating its size, which can lead to an unauthenticated DoS.\n\n### Details\n\n`ParserStream.parseSingle` allocates the body buffer from the declared `Content-Length` with no size c","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/emiago\/sipgo","publishedAt":"2026-09-22T19:57:51Z","exploitedKev":false,"fixedVersion":"1.4.1","vulnerableRange":"<= 1.4.0"},{"id":"GHSA-89vx-jh4q-vg3w","title":"deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes","aliases":["CVE-2026-63116"],"summary":"## Summary\n\nThe `RECORD_ACTION.PATCH_MULTI` action is not registered in the Valve permission system's `RULES_MAP` (`src\/services\/permission\/valve\/rules-map.ts`). When `ConfigPermission.canPerformAction()` is called for a PATCH_MULTI message, `getRulesForMessage()` returns `null` ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@deepstream\/server","publishedAt":"2026-09-22T19:56:34Z","exploitedKev":false,"fixedVersion":"10.1.1","vulnerableRange":"= 10.1.0"},{"id":"GHSA-r3r9-wp5j-pq5g","title":"request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process","aliases":["CVE-2026-62985"],"summary":"### Summary\n`RequestFilteringHttpAgent` \/ `RequestFilteringHttpsAgent` block requests to private IPs, but the blocking happens via a **synchronous `throw`** inside `createConnection()` for literal private-IP hostnames (e.g. `169.254.169.254`, `127.0.0.1`). Node.js's `http.request","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"request-filtering-agent","publishedAt":"2026-09-22T19:54:18Z","exploitedKev":false,"fixedVersion":"3.2.1","vulnerableRange":"< 3.2.1"},{"id":"GHSA-8q6g-vjhf-jp8m","title":"psd-tools composite\/numpy has uncontrolled memory allocation via crafted PSD geometry","aliases":["CVE-2026-59991"],"summary":"### Summary\n`PSDImage.composite()` (and `.numpy()`) allocate the output image buffer from the PSD's header geometry (width \u00d7 height \u00d7 channels \u00d7 depth, and per-layer rectangles) before validating those values against the actual file contents. A tiny crafted PSD declaring huge dim","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"psd-tools","publishedAt":"2026-09-22T19:45:51Z","exploitedKev":false,"fixedVersion":"1.17.4","vulnerableRange":"< 1.17.4"},{"id":"GHSA-5mj8-gf6m-fhw8","title":"9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header","aliases":["CVE-2026-56681"],"summary":"## Summary\n\n9router determines whether an incoming request originates from localhost by trusting the X-9r-Real-Ip HTTP request header. This header is intended to be produced and sanitized exclusively by the bundled custom-server.js layer from the TCP socket address. In deployment","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"9router","publishedAt":"2026-09-22T16:34:06Z","exploitedKev":false,"fixedVersion":"0.5.8","vulnerableRange":"<= 0.5.4"},{"id":"GHSA-92cr-jxw4-5wjg","title":"Sync-in Server has a complete 2FA Bypass via `POST \/api\/auth\/token`","aliases":["CVE-2026-58269"],"summary":"**Affected component:** Sync-in Server v2.3.0, `POST \/api\/auth\/token` (`auth.controller.ts:50-55`).\n\n**Required attacker capability:** Valid username and password for a 2FA-enabled account.\n\n## Summary\n\n`POST \/api\/auth\/token` authenticates with username and password only, then ca","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@sync-in\/server","publishedAt":"2026-09-22T14:46:30Z","exploitedKev":false,"fixedVersion":"2.4.0","vulnerableRange":"<= 2.3.0"},{"id":"GHSA-jjhp-8crj-mppq","title":"@roomi-fields\/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory","aliases":["CVE-2026-61647"],"summary":"## Summary\n\nThe `vault_batch` MCP tool (and the equivalent `POST \/batch-to-vault` HTTP endpoint) accepted a caller-supplied `vault_dir` path that was passed directly to `path.resolve()` + `fs.mkdir()` with no containment check. A caller \u2014 or a prompt-injected LLM driving the MCP ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@roomi-fields\/notebooklm-mcp","publishedAt":"2026-09-22T14:43:26Z","exploitedKev":false,"fixedVersion":"2.0.3","vulnerableRange":">= 1.6.0 < 2.0.3"},{"id":"GHSA-8qpc-6rxx-4pxf","title":"Duplicate Advisory: vllm p2p never connected zmq_exhaustion","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-frvg-qw88-hww9. This link is maintained to preserve external references.\n\n## Original Description\nvLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when Off","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"vllm","publishedAt":"2026-09-22T00:30:55Z","exploitedKev":false,"fixedVersion":"0.30.0","vulnerableRange":">= 0 < 0.30.0"},{"id":"GHSA-pxcx-fv34-x9p5","title":" nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition","aliases":["CVE-2026-61628"],"summary":"## Summary\n\n`POST \/api\/users\/onboarding\/finish` is registered as **anonymous (unauthenticated)** and creates a user with **full ReadWrite admin permissions**. Because the handler uses a check-then-act (TOCTOU) pattern between the \"onboarding already completed?\" check and the user","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/lucasdillmann\/nginx-ignition","publishedAt":"2026-09-21T21:54:42Z","exploitedKev":false,"fixedVersion":"0.0.0-20260621194639-0586b4e55ab","vulnerableRange":"< 0.0.0-20260621194639-0586b4e55ab"},{"id":"GHSA-jr34-h97m-9hpx","title":"nginx ignition has  ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware","aliases":["CVE-2026-61629"],"summary":"### Summary\n\nThe gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org\/x\/text\/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any size or shape filter. The underlying parser has quadratic-ti","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/lucasdillmann\/nginx-ignition","publishedAt":"2026-09-21T21:49:03Z","exploitedKev":false,"fixedVersion":"0.0.0-20260526022344-0c988fc1277c","vulnerableRange":">= 0.0.0-20260126024607-cbaf0fc16ed8 < 0.0.0-20260526022344-0c988fc1277c"},{"id":"GHSA-phg3-3g28-wq9v","title":"Hatchet - Unauthenticated OAuth state CSRF \/ login-CSRF via empty-state collision in ValidateOAuthState","aliases":["CVE-2026-61687"],"summary":"### Summary\n\nHatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF \/ account fixation). \n\nThe vulnerable code clears the session `oauth_state_<integration>` value to the empty string `\"\"` after a successful OAuth callback rather than removing the key, a","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"hatchet","publishedAt":"2026-09-21T15:47:01Z","exploitedKev":false,"fixedVersion":"0.91.1","vulnerableRange":"< 0.91.1"},{"id":"GHSA-68fv-2mgg-jv7q","title":"source-map-js allows event-loop denial of service through indexed source-map section offsets","aliases":["CVE-2026-93749"],"summary":"source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods,","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"source-map-js","publishedAt":"2026-09-18T18:31:44Z","exploitedKev":false,"fixedVersion":"1.2.2","vulnerableRange":">= 1.0.0 < 1.2.2"},{"id":"GHSA-ch52-4w7c-c8xp","title":"http-cache-semantics max-stale handling can disclose cross-user cached responses","aliases":["CVE-2026-93748"],"summary":"http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-s","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"http-cache-semantics","publishedAt":"2026-09-18T18:31:44Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 4.2.0"},{"id":"GHSA-vfj7-8cjw-p6xm","title":"Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns","aliases":["CVE-2026-93687"],"summary":"### Withdrawn Advisory\nThis advisory has been withdrawn because it's not a practically exploitable vulnerability. This link is maintained to preserve external references.\n\n### Original Description\nbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST w","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"braces","publishedAt":"2026-09-18T18:31:41Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.0.3"},{"id":"GHSA-jgh3-fggc-mcpm","title":"Obot: Server-Side Request Forgery via remote MCP server URL","aliases":[],"summary":"## Summary\n\nIn affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched server-side with no validation of the destination. There is no guard against loopback, link-local, RFC1918 private ranges, or the cloud metadata endpoint (`169.2","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/obot-platform\/obot","publishedAt":"2026-09-18T17:59:46Z","exploitedKev":false,"fixedVersion":"0.23.0","vulnerableRange":"< 0.23.0"},{"id":"GHSA-xwmw-prc4-v3cr","title":"Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion","aliases":[],"summary":"## Summary\n\nIn affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external redirect URI, and the authorization flow would auto-complete without a consent screen. If a logged-in victim visited a crafted authorization URL, an authorizati","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/obot-platform\/obot","publishedAt":"2026-09-18T17:59:35Z","exploitedKev":false,"fixedVersion":"0.23.0","vulnerableRange":"< 0.23.0"},{"id":"GHSA-xcw4-53cc-hv32","title":"Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass","aliases":["CVE-2026-59163"],"summary":"### Summary\n\nThe Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data.\n\n**Severit","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mnemosyne-memory","publishedAt":"2026-09-18T17:54:26Z","exploitedKev":false,"fixedVersion":"3.10.1","vulnerableRange":"<= 3.10.0"},{"id":"GHSA-vr5f-w35q-98jp","title":"Perses's unvalidated project parameter enables filesystem path traversal","aliases":["CVE-2026-63445"],"summary":"### Impact\nWhen Perses is using the file system database, on  the list endpoints, the project value is bound from the request into the resource `Query` struct and is never validated against directory-traversal characters (validation\/Flatten only runs for Create\/Update bodies, not","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/perses\/perses","publishedAt":"2026-09-18T17:40:03Z","exploitedKev":false,"fixedVersion":"0.54.0-rc.0","vulnerableRange":"< 0.54.0-rc.0"},{"id":"GHSA-4227-9989-jrhx","title":"Perses's missing authorization in datasource proxy allows cross-scope secret disclosure","aliases":["CVE-2026-63199"],"summary":"### Impact\n\nThe datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret named in the request body with no Secret-scope check.\n\nDatasource and Secret are distinct, independently grantable role scopes, so an operator can grant datasourc","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/perses\/perses","publishedAt":"2026-09-18T17:39:48Z","exploitedKev":false,"fixedVersion":"0.54.0-rc.0","vulnerableRange":">= 0.43.0 < 0.54.0-rc.0"},{"id":"GHSA-cjgj-2fwf-4c2w","title":"Perses's project query parameter authorization bypass exposes cross-project resources","aliases":["CVE-2026-63458"],"summary":"### Impact\n_What kind of vulnerability is it?_\n\nAn authenticated user who is only a viewer on project team-a requests GET \/api\/v1\/projects\/team-a\/dashboards?project=finance-secret (or simply GET \/api\/v1\/datasources?project=finance-secret) and receives the full list of the finance","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/perses\/perses","publishedAt":"2026-09-18T17:39:31Z","exploitedKev":false,"fixedVersion":"0.54.0-beta.3","vulnerableRange":"< 0.54.0-beta.3"},{"id":"GHSA-3753-m2x2-q623","title":"File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer","aliases":["CVE-2026-91127"],"summary":"### Summary\n\nBefore 2.3.1, the legacy `.doc` renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted `.doc` could therefore render a live `javascript:`, `vbscript:`, `data:`, or similarly unsafe link. Script could execute in t","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@file-viewer\/doc","publishedAt":"2026-09-18T17:19:42Z","exploitedKev":false,"fixedVersion":"2.3.1","vulnerableRange":"<= 2.3.0"},{"id":"GHSA-7q85-xj36-vmfc","title":"adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)","aliases":["CVE-2026-77301"],"summary":"### Summary\nadm-zip allocates an entry's output buffer from the declared uncompressed size (central-directory `size` field) before validating it against the actual data. A tiny crafted ZIP that declares a huge uncompressed size forces a multi-gigabyte allocation from a few bytes.","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"adm-zip","publishedAt":"2026-09-18T17:18:01Z","exploitedKev":false,"fixedVersion":"0.6.1","vulnerableRange":"< 0.6.1"},{"id":"GHSA-p5vg-v7mj-f6q4","title":"Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials","aliases":["CVE-2026-81505"],"summary":"## Summary\nfrain-dev\/convoy (all versions up to and including v26.6.2, no patch\navailable) lets any authenticated caller who is authorized on at least one\nproject read ANY OTHER project's \"Source\" record by ID via\nGET \/api\/v1\/projects\/{projectID}\/sources\/{sourceID} -- regardless ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/frain-dev\/convoy","publishedAt":"2026-09-18T17:17:45Z","exploitedKev":false,"fixedVersion":"0.9.3-0.20260724092134-1cc67cd16fb1","vulnerableRange":"< 0.9.3-0.20260724092134-1cc67cd16fb1"},{"id":"GHSA-3w57-8xmc-8v26","title":"AnyIO run_process\/open_process ignores extra_groups and can retain parent supplementary groups","aliases":["CVE-2026-63349"],"summary":"AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, call","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"anyio","publishedAt":"2026-09-18T17:17:23Z","exploitedKev":false,"fixedVersion":"4.14.2","vulnerableRange":">= 4.14.0 < 4.14.2"},{"id":"GHSA-82r6-8w77-94w6","title":"AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing","aliases":["CVE-2026-63374"],"summary":"### Impact\nServices using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's `connect_tcp()` or directly via `TLSStream.wrap()` where the connection has (through other means) been hijacked and redirected to a malicious serve","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"anyio","publishedAt":"2026-09-18T17:17:18Z","exploitedKev":false,"fixedVersion":"4.14.2","vulnerableRange":"< 4.14.2"},{"id":"GHSA-qg2g-g9w3-m5h8","title":"ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement","aliases":["CVE-2026-58197"],"summary":"## Summary\n\nA containerized MCP server running with the default `network` permission profile (`insecure_allow_all: true`) can reach host-local services via `host.docker.internal`. This includes the ToolHive API itself, other ToolHive-managed MCP server proxies, and any other serv","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/stacklok\/toolhive","publishedAt":"2026-09-18T17:16:02Z","exploitedKev":false,"fixedVersion":"0.30.1","vulnerableRange":"< 0.30.1"},{"id":"GHSA-c8w2-fgvx-vhv4","title":"kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups\/warrants and impersonate system:masters in any workspace","aliases":["CVE-2026-61682"],"summary":"# Summary\n\nThe kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own `X-Remote-Group` and `X-Remote-Extra-*` headers, which the shard trusts as a verified identity assertion \u2014 allowing a","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/kcp-dev\/kcp","publishedAt":"2026-09-18T17:15:49Z","exploitedKev":false,"fixedVersion":"0.31.4","vulnerableRange":"< 0.31.4"},{"id":"GHSA-qg67-7m6v-qg25","title":"zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion","aliases":["CVE-2026-61833"],"summary":"### Summary\n\nA bearer token with only `pull` and `push` scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET\/HEAD HTTP methods, including DELETE, to the `\"push\"` action, and the `DistSpecAuthzHandler` middlewar","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"zotregistry.dev\/zot\/v2","publishedAt":"2026-09-18T17:15:19Z","exploitedKev":false,"fixedVersion":"2.1.18","vulnerableRange":"< 2.1.18"},{"id":"GHSA-gjw4-3v3v-rqxg","title":"Capsule: Tenant owner bypasses Capsule's forbidden namespace\/service\/node label and annotation enforcement","aliases":["CVE-2026-61672"],"summary":"## Summary\n\nCapsule lets a cluster administrator forbid specific metadata keys that tenant owners must not place on their own resources: `Tenant.spec.namespaceOptions.forbiddenLabels` \/ `forbiddenAnnotations` (namespaces), `Tenant.spec.serviceOptions.forbiddenLabels` \/ `forbidden","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/projectcapsule\/capsule","publishedAt":"2026-09-18T17:14:31Z","exploitedKev":false,"fixedVersion":"0.13.7","vulnerableRange":"<= 0.13.6"},{"id":"GHSA-39wr-7q6h-cf68","title":"LMDeploy has an SSRF bypass","aliases":[],"summary":"### Summary\nThe URL checking logic in lmdeploy has a logical flaw that could be bypassed by attackers, leading to SSRF attacks.\n\n### Details\nThe current lmdeploy project uses `_is_safe_url` to validate the input URL. The main logic is to perform security checks on the host portio","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lmdeploy","publishedAt":"2026-09-18T17:14:06Z","exploitedKev":false,"fixedVersion":"0.15.0","vulnerableRange":">= 0.12.3 < 0.15.0"},{"id":"GHSA-3hmm-rh5q-gwwr","title":"LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading","aliases":["CVE-2026-33625"],"summary":"### Summary\n\nlmdeploy <= latest contains a code injection vulnerability in `lmdeploy\/pytorch\/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a use","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lmdeploy","publishedAt":"2026-09-18T17:04:01Z","exploitedKev":false,"fixedVersion":"0.12.3","vulnerableRange":">= 0.12.1 < 0.12.3"},{"id":"GHSA-2vh9-42vm-xmv2","title":"LMDeploy has Remote Code Execution\u00a0by Pickle Deserialization via handle_zmq_recv in lmdeploy\/lmdeploy\/pytorch\/disagg\/conn\/engine_conn.py","aliases":["CVE-2025-66455"],"summary":"## Summary\n\nLMDeploy's PyTorch DistServe\/PD-disaggregation control plane used\n`recv_pyobj()` to deserialize messages received through a ZeroMQ PULL\nsocket. PyZMQ implements `recv_pyobj()` using Python pickle\ndeserialization, which can execute arbitrary code while reconstructing\na","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lmdeploy","publishedAt":"2026-09-18T17:03:56Z","exploitedKev":false,"fixedVersion":"0.16.0","vulnerableRange":">= 0.9.2 < 0.16.0"},{"id":"GHSA-jr78-w6w5-m8f8","title":"Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks","aliases":[],"summary":"### Summary\n\nThe `api.php?action=smwtask` API module performs no authorization check. The equivalent maintenance interface in the web UI (`Special:SMWAdmin`) requires the `smw-admin` right, but the API module that backs several of the same operations enforces nothing. An unauthen","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"mediawiki\/semantic-media-wiki","publishedAt":"2026-09-18T16:59:31Z","exploitedKev":false,"fixedVersion":"7.3.0","vulnerableRange":">= 3.0.0 <= 7.2.1"},{"id":"GHSA-hg8h-557g-q8pp","title":"Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes","aliases":["CVE-2025-61682"],"summary":"### Summary\nThe SemanticMediaWiki extension inserts the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext.\n\n### Details\n\nIn `ext.smw.js`, the `data-subtab` attribute of all elements with the `smw-subtab` class is parsed as JSON a","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"mediawiki\/semantic-media-wiki","publishedAt":"2026-09-18T16:07:29Z","exploitedKev":false,"fixedVersion":"7.0.0","vulnerableRange":">= 3.1.0 < 7.0.0"},{"id":"GHSA-9hxx-m5g2-2q3h","title":"Duplicate Advisory: vm2 contains a sandbox escape vulnerability","aliases":[],"summary":"# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-pq68-rvw4-xp4r. This link is maintained to preserve external references.\n\n# Original Description\nvm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BU","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-18T15:32:19Z","exploitedKev":false,"fixedVersion":"3.12.1","vulnerableRange":"< 3.12.1"},{"id":"GHSA-m6c8-jcw2-5r25","title":"Opencast: Stored XSS in Paella player via WebVTT\/DFXP caption cue text","aliases":["CVE-2026-77615"],"summary":"## Summary\n\nThe Opencast Paella player renders caption cue text into `innerHTML` without escaping. The captions canvas clears `_captionsContainer.innerHTML` and then appends each active cue with `_captionsContainer.innerHTML += cue`, so HTML inside a WebVTT or DFXP cue becomes li","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"paella-core","publishedAt":"2026-09-18T13:11:59Z","exploitedKev":false,"fixedVersion":"1.50.6","vulnerableRange":"< 1.50.6"},{"id":"GHSA-r94f-hx44-8jqf","title":"Grav CMS vulnerable to remote code execution via .zip file upload","aliases":["CVE-2026-72819"],"summary":"### Summary\n\nA logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of t","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T20:45:57Z","exploitedKev":false,"fixedVersion":"2.0.13","vulnerableRange":"< 2.0.13"},{"id":"GHSA-xhfv-7758-r9hx","title":"Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin","aliases":["CVE-2026-75837"],"summary":"## Summary\nThe core Flex group blueprint `system\/blueprints\/user\/group.yaml` (access field, lines 48-55) omits the `security@: admin.super` field guard that its sibling account blueprint carries (`account.yaml:131\/138\/150`, added by the CVE-2026-42613 fix). A delegated non-super ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T20:45:15Z","exploitedKev":false,"fixedVersion":"2.0.14","vulnerableRange":"< 2.0.14"},{"id":"GHSA-f8wv-xp27-6gq7","title":"Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write","aliases":["CVE-2026-75827"],"summary":"## Affected versions and vulnerable location\n\n- Confirmed on grav core at `78ebfc1` (tag 2.0.13).\n- Sinks:\n  - `system\/src\/Grav\/Common\/Data\/Blueprint.php:455-458` `call_user_func_array($o, $params)` (bare-function dynamic-data provider).\n  - Twin: `system\/src\/Grav\/Framework\/Flex\/","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T20:44:16Z","exploitedKev":false,"fixedVersion":"2.0.15","vulnerableRange":"<= 2.0.14"},{"id":"GHSA-vfmf-q6x9-cw96","title":"Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS","aliases":["CVE-2026-75828"],"summary":"## Affected versions and vulnerable location\n\n- Confirmed on grav core at `78ebfc1` (tag 2.0.13).\n- Detector: `system\/src\/Grav\/Common\/Security.php:290`, the `on_events` regex, run via `patternMatches()` (`:315-330`).\n- The `on_events` pattern at HEAD:\n  `#<(?:\"[^\"]*\"|'[^']*'|[^>\"","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T20:43:43Z","exploitedKev":false,"fixedVersion":"2.0.15","vulnerableRange":"<= 2.0.14"},{"id":"GHSA-4v9q-p283-qc2m","title":"Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)","aliases":["CVE-2026-74907"],"summary":"**Verified against:** `getgrav\/grav` devel branch, `GRAV_VERSION = \"2.0.15\"`, file `index.php\n\n## Title\nUnauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)\n\n## Product \/ Affected Versions\n- Product: `getg","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T20:43:16Z","exploitedKev":false,"fixedVersion":"2.0.15","vulnerableRange":"<= 2.0.14"},{"id":"GHSA-jq29-c7v8-rg55","title":"Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion","aliases":["CVE-2026-72695"],"summary":"# Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion\n\n## Summary\n\nA path traversal vulnerability in `MediaUploadTrait::deleteFile()` allows an authenticated user with media management permissions to delete arbitrary files on the server. The method val","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T20:34:05Z","exploitedKev":false,"fixedVersion":"2.0.16","vulnerableRange":"<= 2.0.15"},{"id":"GHSA-9gm5-9rfh-m6vx","title":"CoreDNS DoH\/DoQ\/gRPC bypass UPDATE rejection enforced on UDP\/TCP","aliases":["CVE-2026-86003"],"summary":"### Summary\n\nCoreDNS accepted [RFC 2136](https:\/\/datatracker.ietf.org\/doc\/html\/rfc2136) UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC, then allowed the `proxy`\/`forward` plugin to send them unchanged to an upstream DNS server. UDP, TCP, and DoT rejected the same opcode b","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/coredns\/coredns","publishedAt":"2026-09-17T20:33:05Z","exploitedKev":false,"fixedVersion":"1.14.7","vulnerableRange":"<= 1.14.6"},{"id":"GHSA-x424-64qh-5j54","title":"react\/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU","aliases":["CVE-2026-84997"],"summary":"### Summary\n\nA malformed HTTP message using `Transfer-Encoding: chunked` can drive `React\\Http\\Io\\ChunkedDecoder` into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every clien","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"react\/http","publishedAt":"2026-09-17T20:32:39Z","exploitedKev":false,"fixedVersion":"1.11.1","vulnerableRange":">= 0.6.0 <= 1.11.0"},{"id":"GHSA-mrg3-qvqr-jw29","title":"CoreDNS: Unauthenticated memory exhaustion in custom transports","aliases":["CVE-2026-82399"],"summary":"### Summary\n\nCoreDNS parses attacker-controlled DNS section counts before validating them on DNS-over-HTTPS (DoH and DoH3), DNS-over-QUIC (DoQ), and DNS-over-gRPC listeners. An unauthenticated client can use DNS name compression to make one\n65,533-byte request allocate more than ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/coredns\/coredns","publishedAt":"2026-09-17T20:32:27Z","exploitedKev":false,"fixedVersion":"1.14.7","vulnerableRange":"<= 1.14.6"},{"id":"GHSA-xjw9-38cr-6372","title":"djust: A template binding inherits a context safety grant it never earned (XSS)","aliases":[],"summary":"A context safety grant was inherited by a template **binding** that never earned it, so rebinding a name the view had marked safe left the mark attached to the new, attacker-controlled value.\n\ndjust's context safety channel is keyed by **name**, not by value. Every bind copied th","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djust","publishedAt":"2026-09-17T20:31:48Z","exploitedKev":false,"fixedVersion":"1.1.2","vulnerableRange":"<= 1.1.1"},{"id":"GHSA-9395-2g46-rj3f","title":"djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)","aliases":[],"summary":"Five independent defects in djust's template auto-escaping cause attacker-controlled input to be rendered as live markup where Django escapes it. All four are present in shipped 1.1.0 and are fixed in 1.1.1.\n\nThey share one shape: **a filter or grant that escapes nothing itself a","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djust","publishedAt":"2026-09-17T20:31:43Z","exploitedKev":false,"fixedVersion":"1.1.1","vulnerableRange":"<= 1.1.0"},{"id":"GHSA-c3mw-737p-c7g2","title":"Jupyter Server: 5xx request logging leaks token-bearing Referer header values","aliases":["CVE-2026-86049"],"summary":"### Summary\n\nWhen a request returns a 500, `jupyter_server\/log.py` logs a small JSON block of request headers. \n\nThe Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text.\n\n### Impact\n\nAnyone who can read the server logs can pic","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"jupyter_server","publishedAt":"2026-09-17T20:28:55Z","exploitedKev":false,"fixedVersion":"2.21.0","vulnerableRange":"<= 2.20.0"},{"id":"GHSA-vjqc-q4mp-2rvf","title":"CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection","aliases":["CVE-2026-79752"],"summary":"### Impact\nThe `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd($expr, $value, $unit)` methods are vulnerable to SQL injection if user controlled data is supplied to the ($dataType \/ $part \/ $unit) parameters.\n\n### Patches\n5","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"cakephp\/database","publishedAt":"2026-09-17T20:28:14Z","exploitedKev":false,"fixedVersion":"4.6.5","vulnerableRange":">= 4.6.0 < 4.6.5"},{"id":"GHSA-47ch-6w46-6xm7","title":"Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content","aliases":["CVE-2026-72697"],"summary":"## Summary\n\nThe `media_directory()` Twig function is allow-listed for use in sandboxed, editor-authored page content (`system\/config\/security.yaml`). Its implementation, `GravExtension::mediaDirFunc()`, only treats the input as unsafe when it looks like a Grav stream (`user:\/\/`, ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T20:27:47Z","exploitedKev":false,"fixedVersion":"2.0.16","vulnerableRange":"<= 2.0.15"},{"id":"GHSA-3jhr-mxmx-38cx","title":"Grav: UserInterface offsetget\/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()","aliases":["CVE-2026-76839"],"summary":"## Summary\n\n`system\/config\/security.yaml`'s Twig sandbox policy allow-lists `offsetget` and\n`offsetexists` for `Grav\\Common\\User\\Interfaces\\UserInterface`. The concrete\n`Grav\\Common\\User\\DataUser\\User` class does not filter which fields `offsetGet()`\nreturns, so any sandboxed tem","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T20:27:30Z","exploitedKev":false,"fixedVersion":"2.0.16","vulnerableRange":"<= 2.0.15"},{"id":"GHSA-xjw5-q542-3vmr","title":"Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled","aliases":["CVE-2026-76846"],"summary":"## Summary\n\n`system\/config\/security.yaml`'s default `twig_sandbox.config_denied_paths` list\n(`plugins`, `streams`, `security`, `backups`, `scheduler`) omits the `system` prefix.\nWhen an operator enables the documented, non-default `twig_content.config_access: true`\nsetting (inten","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T20:27:05Z","exploitedKev":false,"fixedVersion":"2.0.16","vulnerableRange":"<= 2.0.15"},{"id":"GHSA-p597-crqc-m349","title":"Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths","aliases":["CVE-2026-72698"],"summary":"## Summary\n\n`Grav\\Common\\Twig\\Twig::init()` unconditionally puts the raw `system`, `site`, and `theme` config arrays into `$this->twig_vars`. `Twig::processPage()` builds the variables for the sandboxed, editor-authored page-content render by copying that same base array (`$sandb","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T20:25:42Z","exploitedKev":false,"fixedVersion":"2.0.16","vulnerableRange":"< 2.0.16"},{"id":"GHSA-g4c3-4g96-6g4m","title":"Chamilo LMS CStudio upload flow allows unauthenticated remote code execution","aliases":["CVE-2026-45140"],"summary":"### Impact\nAbility to run arbitrary code on the server without authentication.","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"chamilo\/chamilo-lms","publishedAt":"2026-09-17T20:23:39Z","exploitedKev":false,"fixedVersion":"2.0.1","vulnerableRange":"<= 2.0.0"},{"id":"GHSA-4rf6-qx84-q9fv","title":"Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)","aliases":["CVE-2026-68537"],"summary":"`fulgur` converts untrusted HTML\/CSS into PDF, commonly on a server that\nprocesses input supplied by many tenants. In versions prior to 0.26.0, a\nchildless box that resolves to a pathologically tall height was amplified into\nthousands of blank PDF pages, even when it produces no ","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"fulgur","publishedAt":"2026-09-17T18:49:15Z","exploitedKev":false,"fixedVersion":"0.26.0","vulnerableRange":"< 0.26.0"},{"id":"GHSA-j5cx-ph8g-95v3","title":"Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service","aliases":["CVE-2026-68523"],"summary":"`fulgur` converts untrusted HTML\/CSS into PDF, commonly on a server that\nprocesses input supplied by many tenants. In versions prior to 0.19.0, a\nbody-direct child whose CSS-resolved height greatly exceeds the page height was\nsliced into one fragment per page with **no upper boun","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"fulgur","publishedAt":"2026-09-17T18:48:55Z","exploitedKev":false,"fixedVersion":"0.19.0","vulnerableRange":"< 0.19.0"},{"id":"GHSA-vrf4-mx87-p53w","title":"libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses","aliases":["CVE-2026-86039"],"summary":"### Summary\n`@libp2p\/peer-store` accepts a signed `PeerRecord` whose envelope is signed by one peer but whose payload claims a different peer ID. The vulnerable `consumePeerRecord` path verifies the envelope signature, but does not verify that the envelope signer is the same peer","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@libp2p\/peer-store","publishedAt":"2026-09-17T18:01:38Z","exploitedKev":false,"fixedVersion":"12.0.24","vulnerableRange":">= 8.0.0 < 12.0.24"},{"id":"GHSA-c3gv-825q-fvmp","title":"libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID","aliases":["CVE-2026-86038"],"summary":"### Summary\n`@libp2p\/gossipsub` `StrictSign` validation does not bind a supplied message public key to the claimed `from` peer ID when `from` is an RSA-style peer ID that does not inline its public key. An attacker can set `from` to a victim RSA peer ID, sign the message with the","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@libp2p\/gossipsub","publishedAt":"2026-09-17T17:29:31Z","exploitedKev":false,"fixedVersion":"16.0.5","vulnerableRange":">= 15.0.0 < 16.0.5"},{"id":"GHSA-w3f4-8pj2-599w","title":"Grav: Path Traversal in ImageMedium::watermark() \u2014 arbitrary file disclosure via publicly-cached images","aliases":["CVE-2026-69089"],"summary":"Reported by: Nihad Huseynli (@nihaddhuseynli (https:\/\/github.com\/nihaddhuseynli)) \u2014 nihadd.huseynli@gmail.com\n\n\u258e Note: I attempted to report this via security@getgrav.org first, per SECURITY.md, but the email bounced with 550 5.1.1 Address does not exist. Filing directly here ins","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T17:16:56Z","exploitedKev":false,"fixedVersion":"2.0.11","vulnerableRange":"= 2.0.10"},{"id":"GHSA-7pgq-cr25-xvc8","title":"Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure","aliases":["CVE-2026-69088"],"summary":"### Summary\nGrav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified `Class::method` string, letting an account with only page-editing rights (`admin.pages`, not super-admin) plant a directive in a page's form-field frontmatter that invokes an arbi","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T17:16:39Z","exploitedKev":false,"fixedVersion":"2.0.11","vulnerableRange":">= 2.0.7 <= 2.0.10"},{"id":"GHSA-m37j-52j7-pjw7","title":"oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)","aliases":["CVE-2026-85731"],"summary":"### Summary\nThe `content\/file.Store` in oras-go v2 unpacks OCI layer tarballs when a descriptor carries `io.deis.oras.content.unpack=true`. The extraction routine validates symlink targets purely lexically (`filepath.Join`) and, for regular files placed directly at the extraction","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"oras.land\/oras-go\/v2","publishedAt":"2026-09-17T17:15:57Z","exploitedKev":false,"fixedVersion":"2.6.2","vulnerableRange":"<= 2.6.1"},{"id":"GHSA-c4wf-2xxc-68qm","title":"Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation","aliases":["CVE-2026-65608"],"summary":"### Summary\n\nA missing validation check in Grav's Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with `create` or `update` rights on a Flex-b","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-17T17:15:33Z","exploitedKev":false,"fixedVersion":"2.0.9","vulnerableRange":">= 1.7.0 < 2.0.9"},{"id":"GHSA-5gpm-rgj3-9q76","title":"Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked\/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)","aliases":["CVE-2026-86043"],"summary":"- **Affected component:** `filters\/openpolicyagent\/openpolicyagent.go` \u2192 `ExtractHttpBodyOptionally`; combined with `github.com\/open-policy-agent\/opa-envoy-plugin` `envoyauth\/request.go` \u2192 `getParsedBody` \/ `checkIfHTTPBodyTruncated`. Filter: `opaAuthorizeRequestWithBody`.\n- **Af","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/zalando\/skipper","publishedAt":"2026-09-17T17:05:57Z","exploitedKev":false,"fixedVersion":"0.27.37","vulnerableRange":"< 0.27.37"},{"id":"GHSA-4v58-74mf-rjx3","title":"RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client","aliases":["CVE-2026-77412"],"summary":"**Summary**\nA vulnerability in the readField function allows a malicious or compromised AMQP server to trigger an unhandled runtime panic in the client application, leading to an immediate crash of the entire process.\n\n**Details**\nWhen parsing incoming AMQP frames, the `readField","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rabbitmq\/amqp091-go","publishedAt":"2026-09-17T17:04:29Z","exploitedKev":false,"fixedVersion":"1.13.0","vulnerableRange":"< 1.13.0"},{"id":"GHSA-c5pq-fr2g-9jpf","title":"RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr","aliases":["CVE-2026-77411"],"summary":"**Summary**\n\nA critical stream desynchronization vulnerability has been identified in the AMQP wire-protocol parser. When parsing a long string (`readLongstr`) within a table field, providing a length that exceeds the maximum signed 32-bit integer (`2^31 - 1`, or roughly `2.1` Gi","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rabbitmq\/amqp091-go","publishedAt":"2026-09-17T17:04:25Z","exploitedKev":false,"fixedVersion":"1.13.0","vulnerableRange":"< 1.13.0"},{"id":"GHSA-r9c8-gcjp-xfwh","title":"RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation","aliases":["CVE-2026-77410"],"summary":"**Summary**\nA flaw in the `recvContent` function allows a malicious AMQP server to trigger an Out-of-Memory (OOM) error, forcing the host operating system or container runtime to immediately terminate the client process.\n\n**Vulnerability Details**\nWhen receiving message content p","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rabbitmq\/amqp091-go","publishedAt":"2026-09-17T17:04:20Z","exploitedKev":false,"fixedVersion":"1.13.0","vulnerableRange":"< 1.13.0"},{"id":"GHSA-j497-x9hr-x34x","title":"RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow","aliases":["CVE-2026-77408"],"summary":"## Summary\nA data integrity and protocol corruption vulnerability exists in the AMQP client's property serialization logic. When encoding AMQP short string (`shortstr`) fields\u2014such as identifiers, routing strings, and content metadata\u2014the length of the string is explicitly cast t","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rabbitmq\/amqp091-go","publishedAt":"2026-09-17T17:04:15Z","exploitedKev":false,"fixedVersion":"1.13.0","vulnerableRange":"< 1.13.0"},{"id":"GHSA-27gv-rfvv-22mv","title":"RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields","aliases":["CVE-2026-77407"],"summary":"## Summary\nAn information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the `Connection.Config.SASL` field stores the `Authentication` implementation state used to establish ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rabbitmq\/amqp091-go","publishedAt":"2026-09-17T17:04:10Z","exploitedKev":false,"fixedVersion":"1.13.0","vulnerableRange":"< 1.13.0"},{"id":"GHSA-rm6m-hrcw-jw33","title":"RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration","aliases":["CVE-2026-77406"],"summary":"## Summary\nA logic and resource exhaustion vulnerability exists in the AMQP client's Quality of Service (`Qos`) configuration method. The `Qos` function accepts signed integers (`int`) for the `prefetchCount` and `prefetchSize` parameters but casts them directly to unsigned integ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rabbitmq\/amqp091-go","publishedAt":"2026-09-17T17:04:05Z","exploitedKev":false,"fixedVersion":"1.13.0","vulnerableRange":"< 1.13.0"},{"id":"GHSA-33mj-cw25-m34h","title":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser","aliases":["CVE-2026-77405"],"summary":"## Summary\nA structural security weakness exists in the AMQP client's TLS configuration generator (`tlsConfigFromURI`). When constructing a `*tls.Config` object from an `amqps:\/\/` connection URI, the library initializes the structure without explicitly defining the `MinVersion` f","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rabbitmq\/amqp091-go","publishedAt":"2026-09-17T17:04:01Z","exploitedKev":false,"fixedVersion":"1.13.0","vulnerableRange":"< 1.13.0"},{"id":"GHSA-465g-fh3v-9jw4","title":"RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection","aliases":["CVE-2026-77404"],"summary":"## Summary\nA query parameter injection vulnerability exists in the AMQP client's connection URI formatting logic. When generating or parsing connection URIs, TLS-related filesystem paths (such as certificates or keys) are appended directly to the URI's query string using string c","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rabbitmq\/amqp091-go","publishedAt":"2026-09-17T17:03:55Z","exploitedKev":false,"fixedVersion":"1.13.0","vulnerableRange":"< 1.13.0"},{"id":"GHSA-xwwf-m8fg-p9q2","title":"RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation","aliases":["CVE-2026-77403"],"summary":"## Summary\nA Denial of Service (DoS) vulnerability exists in the AMQP client's connection negotiation logic. The AMQP specification explicitly mandates a strict minimum frame size of 4096 bytes to prevent pathological packet fragmentation. While the library defines a `frameMinSiz","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rabbitmq\/amqp091-go","publishedAt":"2026-09-17T17:03:50Z","exploitedKev":false,"fixedVersion":"1.13.0","vulnerableRange":"< 1.13.0"},{"id":"GHSA-hp3v-5vw7-fx9w","title":"RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution","aliases":["CVE-2026-76825"],"summary":"### Impact\nRestrictedPython could allow a sandbox escape when a policy exposes the standard library `string` module, or otherwise exposes `string.Formatter`, to restricted code.\n\n`string.Formatter` field resolution methods such as `get_field` can perform attribute and item traver","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"RestrictedPython","publishedAt":"2026-09-17T16:30:22Z","exploitedKev":false,"fixedVersion":"8.4","vulnerableRange":"< 8.4"},{"id":"GHSA-pj96-35fp-cfcc","title":"ExifReader: DoS via Crafted HEIC\/AVIF iloc Box - Memory Exhaustion","aliases":["CVE-2026-85715"],"summary":"## Summary\nExifReader 4.41.0 is vulnerable to denial of service through a crafted HEIC or AVIF file with a malicious `iloc` box. When `offsetSize`, `lengthSize`, and `baseOffsetSize` are set to zero in the iloc header, the extent-parsing loop allocates an unbounded number of Java","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"exifreader","publishedAt":"2026-09-17T16:30:00Z","exploitedKev":false,"fixedVersion":"4.41.1","vulnerableRange":"<= 4.41.0"},{"id":"GHSA-hc6q-4vvg-jf79","title":"Duplicate Advisory: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-jxxv-8r27-vm4p. This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attack","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:16Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.11.6"},{"id":"GHSA-mgj2-jqjq-q8gg","title":"Duplicate Advisory: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-gjq8-xm47-88rc. This link is maintained to preserve external references.\n\n## Original Description\nvm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:16Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.10.0 <= 3.11.7"},{"id":"GHSA-538q-xxpg-6h4r","title":"Duplicate Advisory: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-wjwh-qqvp-g4p4. This link is maintained to preserve external references.\n\n## Original Description\nvm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:16Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.10.1 <= 3.11.6"},{"id":"GHSA-28q4-xrqh-9479","title":"Duplicate Advisory: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-8686-vhfx-7r3j. This link is maintained to preserve external references.\n\n## Original Description\nvm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating us","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:16Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.11.6"},{"id":"GHSA-6fvh-fgmg-3x7v","title":"Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-c48m-32m9-vx93. This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:16Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.11.6"},{"id":"GHSA-5v7w-95g5-pj6q","title":"Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-3vgf-8m4q-q4qr. This link is maintained to preserve external references.\n\n## Original Description\nvm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer proto","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:16Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.11.0 <= 3.11.7"},{"id":"GHSA-gg6f-mhqm-f7gp","title":"Duplicate Advisory: Sandbox Escape (NodeVM)","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-88hf-g992-jg85. This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:16Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.11.7"},{"id":"GHSA-9538-79j2-h62h","title":"Duplicate Advisory: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-f8gf-w286-fmq2. This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. Whil","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:16Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.11.7"},{"id":"GHSA-hmpr-c9rf-qcrf","title":"Duplicate Advisory: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-jf8q-945g-9q4c. This link is maintained to preserve external references.\n\n## Original Description\nvm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols a","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:16Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.11.4 <= 3.11.6"},{"id":"GHSA-7c3p-84r8-h79q","title":"Duplicate Advisory: vm2: NodeVM builtin denylist bypass via fs\/promises despite -fs, allowing host filesystem writes","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-6rh5-qq4q-97xh. This link is maintained to preserve external references.\n\n## Original Description\nvm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder us","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:16Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.11.6"},{"id":"GHSA-wqg3-r97q-73xm","title":"Duplicate Advisory: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-qhwx-74w5-xhxq. This link is maintained to preserve external references.\n\n## Original Description\nvm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that p","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:15Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.9.6 <= 3.11.6"},{"id":"GHSA-xq74-c7jx-8w5j","title":"Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-98xx-8mx4-x7cm. This link is maintained to preserve external references.\n\n## Original Description\nvm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, al","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:15Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.11.3 <= 3.11.6"},{"id":"GHSA-29x6-9qh5-83gg","title":"Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-j3hm-6rg5-mchv. This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.7 contains a remote code execution vulnerability when require.external is en","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:15Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.11.6"},{"id":"GHSA-x5qg-8pq6-39h6","title":"Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-fcqc-726x-5wfc This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:15Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.11.6"},{"id":"GHSA-6jgm-4w45-vh8j","title":"Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-46pr-c5wc-xffx. This link is maintained to preserve external references.\n\n## Original Description\nvm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when th","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:14Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.11.3 <= 3.11.6"},{"id":"GHSA-m7cq-7f2q-f9fh","title":"Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite`","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-6w8r-xxw2-g3hx. This link is maintained to preserve external references.\n\n## Original Description\nvm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:14Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.11.3 <= 3.11.6"},{"id":"GHSA-5843-9mh5-hhgw","title":"Duplicate Advisory: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-h85j-hv3c-qfgq. This link is maintained to preserve external references.\n\n## Original Description\nvm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandb","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:14Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.11.3 <= 3.11.6"},{"id":"GHSA-4xmw-hh9q-4q7c","title":"Duplicate Advisory: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-x965-fc75-jpqh. This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbo","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:14Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.11.7"},{"id":"GHSA-9fxx-mv6c-j5xp","title":"Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-8hr7-r645-pc6w. This link is maintained to preserve external references.\n\n## Original Description\nvm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, th","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:14Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.11.4 <= 3.11.6"},{"id":"GHSA-hwr5-cm8v-c76q","title":"Duplicate Advisory: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-27g9-p43v-cw3v. This link is maintained to preserve external references.\n\n## Original Description\nvm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 wher","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:14Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.10.2 <= 3.11.6"},{"id":"GHSA-3f84-vwv5-r42g","title":"Duplicate Advisory: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call\/apply indirection","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-647f-g98j-qq25. This link is maintained to preserve external references.\n\n## Original Description\nvm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host No","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:14Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"= 3.11.6"},{"id":"GHSA-vjcv-9j33-wj62","title":"Duplicate Advisory: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-r4fx-v8hh-22mv. This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-09-17T15:32:14Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.11.6"},{"id":"GHSA-g74q-6g2f-874x","title":"Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site","aliases":["CVE-2026-63506"],"summary":"## Summary\n \n`@tinacms\/auth`'s `isAuthorized(req)` decides authorization by validating the caller's bearer token against `https:\/\/identity.tinajs.io\/v2\/apps\/${req.query.clientID}\/currentUser`, where the `clientID` comes from the request and is never compared to the site's own con","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@tinacms\/auth","publishedAt":"2026-09-17T14:59:00Z","exploitedKev":false,"fixedVersion":"1.1.4","vulnerableRange":"<= 1.1.3"},{"id":"GHSA-84vh-m24q-wjjx","title":"Pocketbase: Unhandled panic in worker goroutines","aliases":["CVE-2026-82410"],"summary":"PocketBase already has builtin panic-recover middleware for the regular requests handling but it doesn't cover panics in internal child\/worker goroutines which in some situations could cause termination of the server process.\n\nTo prevent this from hapenning all existing internal ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/pocketbase\/pocketbase","publishedAt":"2026-09-17T14:58:42Z","exploitedKev":false,"fixedVersion":"0.22.48","vulnerableRange":"< 0.22.48"},{"id":"GHSA-q69g-4hcv-6jg4","title":"@cyclonedx\/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows","aliases":["CVE-2026-71538"],"summary":"## Summary\n\nA **Windows-specific** command injection vulnerability exists in `@cyclonedx\/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option.  \nUser-supplied `--workspace` values can be passed to a shell command without proper neutralization on the Window","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@cyclonedx\/cyclonedx-npm","publishedAt":"2026-09-17T14:50:40Z","exploitedKev":false,"fixedVersion":"6.0.0","vulnerableRange":"< 6.0.0"},{"id":"GHSA-6j36-r6pr-59x4","title":"Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification","aliases":["CVE-2026-63472"],"summary":"# External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification\n\n**Package:** @vendure\/core (vendure-ecommerce\/vendure, latest master) \u00b7 \n\n> [!IMPORTANT]\n> This vulnerability **only affects deployments that use e","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@vendure\/core","publishedAt":"2026-09-17T14:50:22Z","exploitedKev":false,"fixedVersion":"3.7.0","vulnerableRange":"< 3.7.0"},{"id":"GHSA-jgm3-qmp2-c4p7","title":"Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends","aliases":["CVE-2026-63460"],"summary":"### Summary\n\n> [!IMPORTANT] \n> Only instances running on the SQLite driver (better-sqlite3) are affected; SQLite is usually used in development\/testing backend, so production deployments on PostgreSQL or MySQL\/MariaDB are unaffected.\n\nThe `StringOperators.regex` filter exposed on","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@vendure\/core","publishedAt":"2026-09-17T14:49:56Z","exploitedKev":false,"fixedVersion":"3.6.5","vulnerableRange":"<= 3.6.4"},{"id":"GHSA-xhq9-whgq-49j5","title":"Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions","aliases":["CVE-2026-63459"],"summary":"# Stored XSS in the Admin Dashboard via unsafe HTML-stripping (`innerHTML`) of entity descriptions\n\n**Package:** @vendure\/dashboard (vendure-ecommerce\/vendure, latest master) \u00b7 \n\n## Summary\nThe dashboard's `RichTextDescriptionCell` \"strips HTML\" from an entity's `description` by ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@vendure\/dashboard","publishedAt":"2026-09-17T14:49:34Z","exploitedKev":false,"fixedVersion":"3.6.5","vulnerableRange":"< 3.6.5"},{"id":"GHSA-mrx9-2rrp-rhpx","title":"Duplicate Advisory: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-6h2x-m376-mqjq. This link is maintained to preserve external references.\n\n## Original Description\njoi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnera","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"joi","publishedAt":"2026-09-17T00:31:27Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 18.0.0 < 18.2.6"},{"id":"GHSA-mxm6-v9r6-r94c","title":"@nuxtjs\/mdc's URL sanitizer misses SVG xlink:href and data:text\/html, allowing XSS from untrusted markdown at the default configuration","aliases":["CVE-2026-63671"],"summary":"## Summary\n\n`@nuxtjs\/mdc` renders untrusted markdown (including raw HTML) to a Vue component tree. Across two prior advisories it added a URL\/attribute sanitizer to block dangerous links in that HTML: `validateProps` \/ `validateProp` and an `unsafeLinkPrefix` deny-list (`dist\/run","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@nuxtjs\/mdc","publishedAt":"2026-09-16T22:14:01Z","exploitedKev":false,"fixedVersion":"0.22.1","vulnerableRange":"< 0.22.1"},{"id":"GHSA-9pj6-vhgr-3mwh","title":"RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service","aliases":["CVE-2026-63128"],"summary":"### Summary\n\nAn unauthenticated remote attacker can leak one entry per HTTP request out of the in-memory session table of `LocalSessionManager` by sending a well-formed JSON-RPC `POST` that is *not* an `InitializeRequest`. The Streamable HTTP server's `handle_post` allocates the ","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"rmcp","publishedAt":"2026-09-16T22:13:34Z","exploitedKev":false,"fixedVersion":"2.0.0","vulnerableRange":"< 2.0.0"},{"id":"GHSA-33f5-2c5q-wgwj","title":"RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery","aliases":["CVE-2026-63127"],"summary":"### Summary\nThe `rmcp` library does not validate the `resource` parameter in OAuth Protected Resource metadata (RFC 9728), allowing a malicious MCP server to redirect OAuth flows to a legitimate authorization server and steal the resulting access tokens.\n\n### Details\nRFC 9728 spe","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"rmcp","publishedAt":"2026-09-16T22:13:26Z","exploitedKev":false,"fixedVersion":"2.0.0","vulnerableRange":"< 2.0.0"},{"id":"GHSA-7prp-2623-8g45","title":"djust has an unauthenticated arbitrary module import via the WebSocket\/SSE view-mount path","aliases":["CVE-2026-61599"],"summary":"### Impact\nThe djust live transport resolves the LiveView to mount from a **client-supplied dotted path** by calling `__import__(module_path, ...)`. The module is imported \u2014 running its **top-level code (import side effects)** \u2014 *before* the framework checks that the resolved obj","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djust","publishedAt":"2026-09-16T22:09:38Z","exploitedKev":false,"fixedVersion":"1.0.7","vulnerableRange":"< 1.0.7"},{"id":"GHSA-c7c5-5j6r-q957","title":"djust has broken object-level access control (IDOR)","aliases":["CVE-2026-61596"],"summary":"### Impact\ndjust's per-object authorization (`get_object` + `has_object_permission`, ADR-017) was enforced on the WebSocket **mount** and **event** paths but **not** on three other render entry points: (a) the initial **HTTP GET** render, (b) **SPA `url_change`** navigation, and ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djust","publishedAt":"2026-09-16T22:06:02Z","exploitedKev":false,"fixedVersion":"1.0.7","vulnerableRange":"< 1.0.7"},{"id":"GHSA-xhhm-f6hp-2qwj","title":"djust has an authorization bypass on the WebSocket\/SSE mount path","aliases":["CVE-2026-61594"],"summary":"### Impact\nThe live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain. As a result, standard Django authorization \u2014 `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, `@method_decorator(login_required, name=\"","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djust","publishedAt":"2026-09-16T21:58:05Z","exploitedKev":false,"fixedVersion":"1.0.7","vulnerableRange":"< 1.0.7"},{"id":"GHSA-c67v-vqrp-m5wj","title":"djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation \/ state injection)","aliases":["CVE-2026-61591"],"summary":"### Impact\nFor views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored on reconnect as **trusted** view state with no integrity check. A client could edit the unsigned `state_json` in their page and return it in the reconnect mount ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djust","publishedAt":"2026-09-16T21:56:12Z","exploitedKev":false,"fixedVersion":"1.0.7","vulnerableRange":"< 1.0.7"},{"id":"GHSA-f795-p5jw-j6g2","title":"djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)","aliases":["CVE-2026-61592"],"summary":"### Impact\nSSE sessions were keyed solely by a **client-chosen** `session_id` with no binding to the authenticated user \u2014 a control the WebSocket transport has but that was dropped on SSE. An attacker who learns (or a victim who leaks) a `session_id` could connect to the message ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djust","publishedAt":"2026-09-16T21:53:43Z","exploitedKev":false,"fixedVersion":"1.0.7","vulnerableRange":"< 1.0.7"},{"id":"GHSA-r2pf-9cw4-5j65","title":"node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion","aliases":["CVE-2026-68904"],"summary":"SUMMARY\n-------\nA combination of bugs in node-opcua causes unlimited TCP socket accumulation (FIN-WAIT-2 state) during automatic reconnection, leading to memory exhaustion and eventual container\/process crash (OOM kill). The issue is triggered by the default configuration (keepSe","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"node-opcua-transport","publishedAt":"2026-09-16T16:19:21Z","exploitedKev":false,"fixedVersion":"2.170.0","vulnerableRange":">= 2.0.0 < 2.170.0"},{"id":"GHSA-pg97-jvmf-qfvc","title":"djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session","aliases":["CVE-2026-61593"],"summary":"### Impact\nThe SSE client\u2192server POST endpoints are `@csrf_exempt` and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL (which **creates and mounts** a L","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djust","publishedAt":"2026-09-16T15:45:03Z","exploitedKev":false,"fixedVersion":"1.0.7","vulnerableRange":"< 1.0.7"},{"id":"GHSA-5h8j-6crg-7rmw","title":"LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM\/lmdeploy","aliases":["CVE-2025-59953"],"summary":"### Description\n\nThe LMdeploy\u00a0implements an\u00a0rpc server (AsyncRPCServer in zmq_rpc.py)\u00a0for supporting the RPC communications. In its core functionality\u00a0call_and_response(), I found it will directly use the\u00a0pickles.loads()\u00a0to deserialize the received messages without any sanitizati","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lmdeploy","publishedAt":"2026-09-16T15:34:27Z","exploitedKev":false,"fixedVersion":"0.10.2","vulnerableRange":">= 0.9.1 < 0.10.2"},{"id":"GHSA-3492-cvg7-9mr2","title":"djust: Multi-tenant isolation fails open on the WebSocket\/SSE path, disclosing other tenants' data","aliases":["CVE-2026-61595"],"summary":"### Impact\n`djust.tenants` isolation was enforced only on the HTTP path. The current tenant was stored in `threading.local()` and set exclusively by the HTTP-only `TenantMiddleware`, so on the live (WebSocket\/SSE) path `get_current_tenant()` was always `None` during mount and eve","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djust","publishedAt":"2026-09-16T15:32:10Z","exploitedKev":false,"fixedVersion":"1.0.7","vulnerableRange":"< 1.0.7"},{"id":"GHSA-cc7c-9jff-58wj","title":"djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler","aliases":["CVE-2026-61598"],"summary":"### Impact\n`djust.mixins.model_binding.ModelBindingMixin` provides a default `update_model` event handler and is part of the **LiveView base MRO**, so every LiveView exposes it. It `setattr`s a view attribute whose **name is client-supplied** (`field`), gated only by: reject `_`-","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djust","publishedAt":"2026-09-16T13:55:48Z","exploitedKev":false,"fixedVersion":"1.0.7","vulnerableRange":"< 1.0.7"},{"id":"GHSA-8g2f-g3gq-5rjv","title":"djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG","aliases":["CVE-2026-61590"],"summary":"### Impact\ndjust's observability endpoints expose live view\/session state and a remote method-invocation surface (`eval_handler`). The localhost restriction was an **opt-in middleware that the documented setup omits**; the views themselves enforced only `DEBUG`. In the misconfigu","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djust","publishedAt":"2026-09-16T13:49:19Z","exploitedKev":false,"fixedVersion":"1.0.7","vulnerableRange":"< 1.0.7"},{"id":"GHSA-cv3r-c5h8-f4g5","title":"@zereight\/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover","aliases":["CVE-2026-61560"],"summary":"### Summary\n\nThe SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project. Combined, any unau","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@zereight\/mcp-gitlab","publishedAt":"2026-09-16T13:48:28Z","exploitedKev":false,"fixedVersion":"2.1.27","vulnerableRange":"< 2.1.27"},{"id":"GHSA-2h44-8472-frjj","title":"@zereight\/mcp-gitlab Vulnerable to Server-Side Request Forgery","aliases":["CVE-2026-61559"],"summary":"# Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft\n\n## Affected\n\n- **Repository:** `zereight\/gitlab-mcp`\n- **Affected versions:** All versions through commit `74a8c83`\n- **Patched versions:** None at time of report\n\n## Severity\n\nHigh. CVSS v3.1 8.5 ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@zereight\/mcp-gitlab","publishedAt":"2026-09-15T20:57:28Z","exploitedKev":false,"fixedVersion":"2.1.27","vulnerableRange":">= 0.0.1 < 2.1.27"},{"id":"GHSA-vmp7-252j-cwp7","title":"@zereight\/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport","aliases":["CVE-2026-61568"],"summary":"`@zereight\/mcp-gitlab` exposes its Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled `Host` and `Origin`. The se","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@zereight\/mcp-gitlab","publishedAt":"2026-09-15T20:54:55Z","exploitedKev":false,"fixedVersion":"2.1.30","vulnerableRange":"< 2.1.30"},{"id":"GHSA-5648-rgj9-v224","title":"@zereight\/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS","aliases":[],"summary":"### Summary\n@zereight\/mcp-gitlab exposes GitLab to an LLM agent while relying on read-only mode, a project allow-list, and transport auth as its safety controls. Five defects defeat those controls. Under the MCP threat model, tool-call arguments\/content can be shaped by untrusted","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@zereight\/mcp-gitlab","publishedAt":"2026-09-15T20:48:22Z","exploitedKev":false,"fixedVersion":"2.1.30","vulnerableRange":"< 2.1.30"},{"id":"GHSA-4595-rvpx-4q34","title":"emp3r0r has an unauthenticated HTTP Polling DoS","aliases":["CVE-2026-61554"],"summary":"### Summary\nThe `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch pa","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/jm33-m0\/emp3r0r\/core","publishedAt":"2026-09-15T20:47:17Z","exploitedKev":false,"fixedVersion":"0.0.0-20260531142011-aed3d81641ab","vulnerableRange":"< 0.0.0-20260531142011-aed3d81641ab"},{"id":"GHSA-5hq8-qhww-jm7q","title":"libp2p-quic: Remote panic via certificate expiry race during QUIC handshake","aliases":["CVE-2026-61544"],"summary":"### Summary\n\n`libp2p-quic` can panic on an inbound QUIC handshake if a malicious peer presents a valid, short lived libp2p TLS certificate and delays the final TLS 1.3 handshake fragment until the certificate expires.\n\nThis is remotely reachable by a network peer and can crash ap","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"libp2p-quic","publishedAt":"2026-09-15T20:01:17Z","exploitedKev":false,"fixedVersion":"0.13.1","vulnerableRange":"< 0.13.1"},{"id":"GHSA-m4vj-wr5q-cmvr","title":"Duplicate Advisory: Vikunja: Every \/api\/v2 pre-auth endpoint is unthrottled on a stock install while its \/api\/v1 twin is rate limited","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6rvj-qwjf-3m4q. This link is maintained to preserve external references.\n\n### Original Description\nVikunja versions before 2.6.0 fail to apply rate limiting to \/api\/v2 public authentication ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/go-vikunja\/vikunja","publishedAt":"2026-09-15T18:32:30Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 2.5.0"},{"id":"GHSA-p4h8-xg7f-xqrc","title":"Duplicate Advisory: Vikunja: Denial of service via decompression bomb in the data import","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-w7jp-mf2v-8342. This link is maintained to preserve external references.\n\n### Original Description\nVikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenti","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/go-vikunja\/vikunja","publishedAt":"2026-09-15T18:32:30Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 2.5.0"},{"id":"GHSA-37rx-7pj5-p885","title":"Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-qfwc-vx6f-3g6g. This link is maintained to preserve external references.\n\n### Original Description\nVikunja before 2.6.0 fails to properly restrict access to the link-share hash field in sing","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-09-15T18:32:30Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 2.5.0"},{"id":"GHSA-c2g7-39fr-cp8q","title":"Duplicate Advisory: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-wq92-8x3r-fm38. This link is maintained to preserve external references.\n\n### Original Description\nVikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka mig","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-09-15T18:32:30Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 2.5.0 < 2.6.0"},{"id":"GHSA-55p4-8j34-jv53","title":"Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-pqf9-h8g4-8gmh. This link is maintained to preserve external references.\n\n### Original Description\nvikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST \/api\/","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-09-15T18:32:30Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"= 2.5.0"},{"id":"GHSA-jfw3-2gcf-23r5","title":"Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xxc3-xpmc-vmvr. This link is maintained to preserve external references.\n\n### Original Description\nvikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filte","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-09-15T18:32:30Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"= 2.5.0"},{"id":"GHSA-p2vv-wrh8-x466","title":"Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-m469-88xx-8rx2. This link is maintained to preserve external references.\n\n### Original Description\nVikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth en","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-09-15T18:32:30Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 2.5.0"},{"id":"GHSA-69rj-q3v9-vffp","title":"Duplicate Advisory: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode\/resize amplification","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-4vh2-39rq-rq8j. This link is maintained to preserve external references.\n\n### Original Description\nVikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background up","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-09-15T18:32:30Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 2.5.0"},{"id":"GHSA-vrh8-c9cm-wh8v","title":"ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange","aliases":["CVE-2026-56668"],"summary":"### Summary\n\nA vulnerability in ZITADEL\u2019s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/zitadel\/zitadel","publishedAt":"2026-09-14T21:28:23Z","exploitedKev":false,"fixedVersion":"4.15.3","vulnerableRange":"< 4.15.3"},{"id":"GHSA-rrxg-g2pf-6hh4","title":"ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade","aliases":["CVE-2026-59178"],"summary":"## Summary\n\nThe dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earlier versions, and the legacy `esphome` dashboard, read the bare `$USERNAME` and `$PASSWORD` instead. When the env vars were renamed the bare names were dropped wit","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"esphome-device-builder","publishedAt":"2026-09-14T18:08:57Z","exploitedKev":false,"fixedVersion":"1.0.12","vulnerableRange":"< 1.0.12"},{"id":"GHSA-vm5r-23w9-m8hx","title":"Duplicate Advisory: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-prgh-xp8r-p3m5. This link is maintained to preserve external references.\n\n## Original Description\nNodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability i","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nodemailer","publishedAt":"2026-09-13T12:31:12Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 9.1.0 <= 10.0.4"},{"id":"GHSA-325j-mg25-8q58","title":"yayson: Prototype pollution in Store\/LegacyStore deserialization","aliases":["CVE-2026-61534"],"summary":"# Summary\n`Store`\/`LegacyStore` key internal lookup tables by the `type`, `id`, and relationship names from a JSON:API document. Because these were plain objects, a document with `type: \"__proto__\"` writes onto `Object.prototype`, polluting every object in the process.\n\n# Severit","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"yayson","publishedAt":"2026-09-11T22:11:38Z","exploitedKev":false,"fixedVersion":"4.3.0","vulnerableRange":"<= 4.2.0"},{"id":"GHSA-rqx4-3f6q-3x2v","title":"@Mockoon\/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft","aliases":["CVE-2026-59148"],"summary":"## Summary\n\nMockoon's admin API ([`commons-server\/src\/libs\/server\/admin-api.ts`](https:\/\/github.com\/mockoon\/mockoon\/blob\/4375a8f\/packages\/commons-server\/src\/libs\/server\/admin-api.ts)) is mounted on the same Express listener as the user-defined mock routes, **enabled by default** ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@mockoon\/commons-server","publishedAt":"2026-09-11T22:04:42Z","exploitedKev":false,"fixedVersion":"9.7.0","vulnerableRange":"< 9.7.0"},{"id":"GHSA-65h7-9wrw-629c","title":"FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix","aliases":["CVE-2026-59973"],"summary":"## Summary\n\nThe published fix for GHSA-v6ph-xcq9-qxxj \/ CVE-2026-39885 added a direct hostname denylist for OpenAPI external `$ref` dereferencing, but the latest patched dependency `mcp-from-openapi` 2.3.0 still makes backend-origin requests to loopback when the target is reached","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"mcp-from-openapi","publishedAt":"2026-09-11T22:02:04Z","exploitedKev":false,"fixedVersion":"2.5.0","vulnerableRange":">= 2.3.0 < 2.5.0"},{"id":"GHSA-h8m9-jgf8-vwvp","title":"Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover","aliases":["CVE-2026-59151"],"summary":"## SAML Tenant Binding Enables Cross-Tenant Account Takeover\n\n### Summary\n\nProwler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token. A malicious tenant with its own SAML configuration and a se","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"prowler-cloud","publishedAt":"2026-09-11T21:38:24Z","exploitedKev":false,"fixedVersion":"5.30.3","vulnerableRange":"< 5.30.3"},{"id":"GHSA-2cg9-97gq-9mqp","title":"Shopper: Missing authorization on product removal actions in CollectionProducts component","aliases":["CVE-2026-56825"],"summary":"## Title\n\nMissing authorization on product removal actions in CollectionProducts component\n\n## Description\n\nA lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside `packages\/admin\/src\/Livewire\/Components\/Collection\/Col","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"shopper\/framework","publishedAt":"2026-09-11T21:31:26Z","exploitedKev":false,"fixedVersion":"2.9.2","vulnerableRange":"< 2.9.2"},{"id":"GHSA-g3f9-g5vj-p62f","title":"Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component","aliases":["CVE-2026-56829"],"summary":"## Title\n\nUnauthorized inventory stock manipulation via unlocked variant property in VariantStock component\n\n## Description\n\nA lack of authorization control was discovered in the `stockAction()` method in `packages\/admin\/src\/Livewire\/Components\/Products\/VariantStock.php`. The com","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"shopper\/framework","publishedAt":"2026-09-11T21:29:20Z","exploitedKev":false,"fixedVersion":"2.9.2","vulnerableRange":"< 2.9.2"},{"id":"GHSA-j328-xmgp-j4q3","title":"Shopper: privilege escalation via improper Livewire admin component authorization","aliases":["CVE-2026-56828"],"summary":"## Summary\n\nThree Livewire admin components in `shopper\/framework` (latest master at commit `fcd0c59`, released as v2.8.0) gate state-mutating actions on the read-only `view_users` permission. This is the same class as the issue Shopper fixed in v2.8.0 \/ PR #511 \/ [GHSA-f946-9qp6","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"shopper\/framework","publishedAt":"2026-09-11T21:28:54Z","exploitedKev":false,"fixedVersion":"2.9.2","vulnerableRange":">= 2.8.0 < 2.9.2"},{"id":"GHSA-243p-f3cv-c5wh","title":"Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes\/tags and mass-toggle visibility of brands\/categories\/suppliers","aliases":["CVE-2026-56827"],"summary":"## Summary\n\nFive Filament `groupedBulkActions` blocks across the Shopper admin Livewire pages omit the `->authorize(...)` permission gate, while their per-record sibling actions (and other Shopper Index pages such as `Pages\/Settings\/Currencies.php`, `Pages\/Reviews\/Index.php`, `Pa","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"shopper\/framework","publishedAt":"2026-09-11T20:47:17Z","exploitedKev":false,"fixedVersion":"2.9.2","vulnerableRange":"< 2.9.2"},{"id":"GHSA-rqfv-2mw9-78g2","title":"MySQL MCP Server: Missing Origin\/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding \/ Direct Exposure)","aliases":["CVE-2026-59971"],"summary":"## Summary\n\nIn SSE\/HTTP transport mode, `mysql_mcp_server` constructs `SseServerTransport` without passing `security_settings`. As a result, the MCP Python SDK's DNS-rebinding protection (Origin\/Host header validation) is disabled; the Starlette application has no CORS or Trusted","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mysql-mcp-server","publishedAt":"2026-09-11T20:35:42Z","exploitedKev":false,"fixedVersion":"0.4.2","vulnerableRange":"< 0.4.2"},{"id":"GHSA-w4v4-9rw7-5326","title":"Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request\/Response Smuggling') and Incorrect Authorization","aliases":["CVE-2026-88008"],"summary":"## Summary\n\nThere is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP\/1.1 `Upgrade` mechanism. Since Traefik moved to unencrypted HTTP\/2 with prior knowledge (Go 1.24), a client-initiated `Upgrade: h2c` request header and its connection-specific `","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/traefik\/traefik\/v3","publishedAt":"2026-09-10T23:04:37Z","exploitedKev":false,"fixedVersion":"3.7.13","vulnerableRange":">= 3.4.2 < 3.7.13"},{"id":"GHSA-v67p-phpq-fc8x","title":"Traefik entrypoint header-name sanitization bypassed via request trailers","aliases":["CVE-2026-88004"],"summary":"## Summary\n\nTraefik's entrypoint defenses against spoofed trusted header names \u2014 `aliasHeadersStrategy` \/ `underscoreHeadersStrategy` in `delete` or `reject` mode, and the default `forwardedHeaders` stripping of client-supplied `X-Forwarded-*` \u2014 scan `req.Header` only and never `","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/traefik\/traefik\/v3","publishedAt":"2026-09-10T23:04:21Z","exploitedKev":false,"fixedVersion":"3.7.13","vulnerableRange":">= 3.2.0 < 3.7.13"},{"id":"GHSA-qqjf-53cj-pwvv","title":"Traefik HTTP\/3 Backend NTLM Connection Reuse","aliases":["CVE-2026-88007"],"summary":"## Summary\n\nTraefik's HTTP\/3 request path did not initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate (Kerberos) authentication on the HTTP\/1.1 and HTTP\/2 paths. The HTTP\/3 entrypoint reuses the HTTPS handler chain and reach","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/traefik\/traefik\/v3","publishedAt":"2026-09-10T23:04:06Z","exploitedKev":false,"fixedVersion":"3.7.13","vulnerableRange":">= 3.0.0 < 3.7.13"},{"id":"GHSA-f52w-8j3h-j724","title":"Traefik: Rootless HTTP\/1 request-target routes as \"\/\" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging","aliases":["CVE-2026-88009"],"summary":"## Summary\n\nTraefik accepts an HTTP\/1.x request whose request-target is in rootless \/ opaque form (for example `GET http:http:\/\/internal-vhost\/admin HTTP\/1.1`). Go parses this into `URL.Opaque` with an empty `URL.Path`, so Traefik evaluates all routing, path-sanitization, middlew","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/traefik\/traefik\/v3","publishedAt":"2026-09-10T23:03:53Z","exploitedKev":false,"fixedVersion":"3.7.13","vulnerableRange":">= 3.0.0 < 3.7.13"},{"id":"GHSA-xwwr-4h3p-r22c","title":"rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass","aliases":["CVE-2026-88018"],"summary":"### Summary\n`rclone serve s3`'s handler chain, when `--auth-proxy` is configured, is (outermost first): `authPairMiddleware` -> `proxyAuthMiddleware` -> gofakes3's own SigV4-verifying handler.\n\n`authPairMiddleware` parses the accessKeyID straight out of the incoming request's own","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rclone\/rclone","publishedAt":"2026-09-10T22:49:07Z","exploitedKev":false,"fixedVersion":"1.75.1","vulnerableRange":"< 1.75.1"},{"id":"GHSA-p569-5gjg-9cmj","title":"rclone: RC per-server auth-proxy bypass","aliases":["CVE-2026-88044"],"summary":"## Summary\n\n`serve\/start` accepts protocol options in a per-server `proxyOpt` object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global `proxy.O","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rclone\/rclone","publishedAt":"2026-09-10T22:47:10Z","exploitedKev":false,"fixedVersion":"1.75.1","vulnerableRange":">= 1.70.0 < 1.75.1"},{"id":"GHSA-c476-6w5q-jw77","title":"rclone: FTP cross-session auth-proxy backend confusion","aliases":["CVE-2026-88017"],"summary":"## Summary\n\nThe FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the l","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rclone\/rclone","publishedAt":"2026-09-10T22:46:33Z","exploitedKev":false,"fixedVersion":"1.75.1","vulnerableRange":">= 1.64.0 <= 1.75.0"},{"id":"GHSA-2p48-j3qc-rx9f","title":"rclone: S3 multipart declared-length memory exhaustion","aliases":["CVE-2026-88045"],"summary":"## Summary\n\nIn streamed multipart mode, `serve s3` passes the request's declared part length to `multipart.NewRW().Reserve(contentLength)` before reading any part data. `Reserve` immediately obtains enough 1 MiB pool pages for the entire declared length. The request handler there","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rclone\/rclone","publishedAt":"2026-09-10T22:45:14Z","exploitedKev":false,"fixedVersion":"1.75.1","vulnerableRange":"= 1.75.0"},{"id":"GHSA-3g9q-v48f-hh9w","title":"Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout","aliases":["CVE-2026-87011"],"summary":"## Summary\n\nThe OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"open-webui","publishedAt":"2026-09-10T22:44:42Z","exploitedKev":false,"fixedVersion":"0.11.1","vulnerableRange":">= 0.9.0 <= 0.11.0"},{"id":"GHSA-4qpv-39hg-f7fx","title":"@jhb.software\/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission","aliases":["CVE-2026-59965"],"summary":"## Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission\n\n### Summary\n\n`@jhb.software\/payload-alt-text-plugin` v0.7.0 exposes custom Payload CMS endpoints (`POST \/api\/alt-text-plugin\/generate` and `\/bulk`) that call the Payload Local API (`findByI","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@jhb.software\/payload-alt-text-plugin","publishedAt":"2026-09-10T22:39:14Z","exploitedKev":false,"fixedVersion":"0.8.0","vulnerableRange":"< 0.8.0"},{"id":"GHSA-4x45-gxvp-6283","title":"@argos-ci\/core: CI Branch Name OS Command Injection","aliases":["CVE-2026-59960"],"summary":"## CI Branch Name OS Command Injection in @argos-ci\/core\n\n### Summary\n\n`@argos-ci\/core@6.2.0` passes attacker-controlled CI branch\/ref strings directly into an `execSync()` template literal in `packages\/core\/src\/ci-environment\/git.ts:89`. When a CI project has `hasRemoteContentAc","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@argos-ci\/core","publishedAt":"2026-09-10T22:34:17Z","exploitedKev":false,"fixedVersion":"6.2.1","vulnerableRange":"<= 6.2.0"},{"id":"GHSA-m3wp-48jr-vr4g","title":" mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS","aliases":[],"summary":"## Unbounded Remote Media Fetch and Video Frame Expansion DoS\n\n### Summary\nThe `POST \/v1\/chat\/completions` endpoint in mistral.rs fetches attacker-supplied media URLs (image, audio, video) into server memory with no byte limit, and extracts every frame of a supplied video when `n","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"mistralrs-server-core","publishedAt":"2026-09-10T21:54:37Z","exploitedKev":false,"fixedVersion":"0.8.18","vulnerableRange":"<= 0.8.4"},{"id":"GHSA-wfgq-w7cq-qj7j","title":"mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url","aliases":[],"summary":"### Summary\nmistral.rs fetches any request-supplied image\/audio URL with no host or IP validation, and opens arbitrary local files (a `file:\/\/` URL, or any existing relative\/absolute path). A remote, unauthenticated client of any vision\/audio deployment can cause the server to is","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"mistralrs-server-core","publishedAt":"2026-09-10T21:54:14Z","exploitedKev":false,"fixedVersion":"0.8.18","vulnerableRange":"<= 0.8.17"},{"id":"GHSA-wpmr-8h3q-fwj7","title":"Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite","aliases":["CVE-2026-87016"],"summary":"## Summary\n\nOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"open-webui","publishedAt":"2026-09-10T21:23:25Z","exploitedKev":false,"fixedVersion":"0.11.1","vulnerableRange":">= 0.6.41 < 0.11.1"},{"id":"GHSA-hf57-cqmx-p4gr","title":" OmniRoute ACP Custom-Agent Remote Code Execution (RCE)","aliases":["CVE-2026-88062"],"summary":"## 2. Summary\n\n`POST \/api\/acp\/agents` registers a custom ACP agent. The endpoint accepts user-controlled\n`binary` and `versionCommand` values. After saving the custom agent, the same request calls\n`refreshAgentCache()`, which triggers agent version detection. The version probe ev","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"omniroute","publishedAt":"2026-09-10T21:22:12Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.8.50"},{"id":"GHSA-6xcw-7xm6-48c6","title":"n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution","aliases":["CVE-2026-86083"],"summary":"## Impact\n\nTwo stages of expression code generation built source text by calling the global `JSON.stringify` at generation time: the compiler when printing synthetic string literals, and the isolate bridge when interpolating a timezone value into its per-evaluation wrapper. An ex","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"n8n","publishedAt":"2026-09-10T20:37:21Z","exploitedKev":false,"fixedVersion":"1.123.76","vulnerableRange":"< 1.123.76"},{"id":"GHSA-v3p8-whq6-r5jg","title":"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements","aliases":["CVE-2026-88060"],"summary":"### Summary\nAn XSS vulnerability exists in `@angular\/platform-server` during server-side rendering (SSR) HTML serialization when traversing ancestor tags across `<template>` element boundaries. When an application renders untrusted user input within raw-text tags (`<xmp>`, `<styl","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@angular\/platform-server","publishedAt":"2026-09-10T20:25:25Z","exploitedKev":false,"fixedVersion":"22.1.4","vulnerableRange":">= 22.0.0 < 22.1.4"},{"id":"GHSA-f6mr-pjwc-34m4","title":"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR","aliases":["CVE-2026-88056"],"summary":"### Summary\nA discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery (SSRF), potentially leaking sensitive server-side credentials.\n\n### Technical Description\nWhen applications va","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@angular\/platform-server","publishedAt":"2026-09-10T20:19:43Z","exploitedKev":false,"fixedVersion":"22.1.4","vulnerableRange":">= 22.0.0 < 22.1.4"},{"id":"GHSA-23rh-xw42-fq82","title":"Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration","aliases":["CVE-2026-55416"],"summary":"# Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration\n\n## Summary\n\n### Impact\n\nA SQL injection vulnerability exists in the Custom Reports bundle (`bundles\/CustomReportsBundle\/src\/Tool\/Adapter\/Sql.php:84-135`). An authenticated attacker with `repo","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"pimcore\/pimcore","publishedAt":"2026-09-10T19:25:05Z","exploitedKev":false,"fixedVersion":"2026.1.6","vulnerableRange":">= 2026.1.0 <= 2026.1.5"},{"id":"GHSA-w47m-jpv2-qfw5","title":"Duplicate Advisory: Knowns Sandbox Escape: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9h2q-r9fh-f98w. This link is maintained to preserve external references.\n\n### Original Description\nknowns versions before 0.31.0 fail to properly validate the x-opencode-directory request he","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"knowns","publishedAt":"2026-09-10T18:31:45Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 0.31.0"},{"id":"GHSA-34ff-336r-5q23","title":"n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node","aliases":["CVE-2026-86082"],"summary":"## Impact\n\nThe OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting `options.baseURL` on that path reached an arbitrary host with the credential a","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"n8n","publishedAt":"2026-09-10T15:12:14Z","exploitedKev":false,"fixedVersion":"1.123.76","vulnerableRange":"< 1.123.76"},{"id":"GHSA-j535-v25q-vx3q","title":"n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path","aliases":["CVE-2026-86081"],"summary":"## Impact\n\nThe Git node's clone operation matched the destination path against the default `N8N_BLOCK_FILE_PATTERNS` expression, which was written so that a crafted path caused catastrophic backtracking. Evaluation runs synchronously in the main n8n process, so an authenticated u","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"n8n","publishedAt":"2026-09-10T15:12:00Z","exploitedKev":false,"fixedVersion":"1.123.76","vulnerableRange":"< 1.123.76"},{"id":"GHSA-hh89-3r9w-qj3j","title":"n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint","aliases":["CVE-2026-86075"],"summary":"## Impact\n\nThe OAuth Dynamic Client Registration endpoints validated field sizes only for `redirect_uris`, leaving `client_name` and `grant_types` bounded by presence checks alone. An unauthenticated remote caller could submit arbitrarily large values in either field and have the","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"n8n","publishedAt":"2026-09-10T15:11:31Z","exploitedKev":false,"fixedVersion":"2.38.2","vulnerableRange":">= 2.38.0 < 2.38.2"},{"id":"GHSA-hw8v-xxg5-vvvx","title":"n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution","aliases":["CVE-2026-86076"],"summary":"## Impact\n\nThe expression compiler's sanitizer resolved through a dynamically-scoped `this`, so a class field named `__sanitize` rebound it and reached the `Function` constructor. On the backend, any expression author could run code in the n8n process; in the editor preview, a me","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"n8n","publishedAt":"2026-09-10T15:11:07Z","exploitedKev":false,"fixedVersion":"1.123.76","vulnerableRange":"< 1.123.76"},{"id":"GHSA-jmc6-2wr8-h3wj","title":"Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin","aliases":["CVE-2026-87995"],"summary":"## Summary\nAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted `allow-same-origin` alon","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"open-webui","publishedAt":"2026-09-10T15:10:20Z","exploitedKev":false,"fixedVersion":"0.11.1","vulnerableRange":">= 0.8.11 <= 0.11.0"},{"id":"GHSA-4v28-j6q3-5m4r","title":"Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader","aliases":["CVE-2026-87996"],"summary":"## Summary\nWith the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never chec","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"open-webui","publishedAt":"2026-09-10T15:10:12Z","exploitedKev":false,"fixedVersion":"0.11.1","vulnerableRange":">= 0.9.6 < 0.11.1"},{"id":"GHSA-2724-6cpj-gf3v","title":"Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion","aliases":["CVE-2026-87998"],"summary":"## Summary\nExternal knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role a","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"open-webui","publishedAt":"2026-09-10T15:09:52Z","exploitedKev":false,"fixedVersion":"0.11.1","vulnerableRange":">= 0.10.0 < 0.11.1"},{"id":"GHSA-34r3-9m95-vq73","title":"Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch","aliases":["CVE-2026-87999"],"summary":"## Summary\n\nOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"open-webui","publishedAt":"2026-09-10T15:09:36Z","exploitedKev":false,"fixedVersion":"0.11.1","vulnerableRange":"< 0.11.1"},{"id":"GHSA-q5j5-6p94-4gwc","title":"Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation","aliases":["CVE-2026-59161"],"summary":"# Streaming GetRows row-bound bypass causes attacker-controlled allocation\n\n## Summary\n\nExcelize's prior row-bound fix for GHSA-h69g \/ CVE-2026-54063 protects the checked worksheet parser, but the streaming worksheet reader used by `Rows` and `GetRows` does not enforce the same `","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/xuri\/excelize\/v2","publishedAt":"2026-09-10T15:09:09Z","exploitedKev":false,"fixedVersion":"2.11.0","vulnerableRange":"< 2.11.0"},{"id":"GHSA-x7m8-jrm8-hpvx","title":"@eigenpal\/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name","aliases":[],"summary":"## Summary\nEmbedded font-family names (`word\/fontTable.xml`) were interpolated unescaped into an injected `@font-face` `<style>` and into the print window's `document.write()`. A crafted name injects page-wide CSS on open, and breaks out of `<style>`\n  into executable HTML on Pri","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@eigenpal\/docx-editor-core","publishedAt":"2026-09-10T15:06:16Z","exploitedKev":false,"fixedVersion":"1.8.3","vulnerableRange":"<= 1.8.2"},{"id":"GHSA-cp3j-m783-3ph5","title":"Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification","aliases":["CVE-2026-59185"],"summary":"## Summary\n\nidentrail's GitHub App connection-completion endpoint binds a fully client-supplied `installation_id` to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/identrail\/identrail","publishedAt":"2026-09-09T23:52:14Z","exploitedKev":false,"fixedVersion":"1.0.2","vulnerableRange":"< 1.0.2"},{"id":"GHSA-g72f-jw3w-mgh7","title":"@openhop\/server: Path Traversal in Flow ID File Operations","aliases":["CVE-2026-59179"],"summary":"## Path Traversal in Flow ID File Operations\n\n### Summary\n\n`@openhop\/server` passes unsanitized HTTP route parameters directly to `path.join()` when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read arbitrary `.yaml` ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@openhop\/server","publishedAt":"2026-09-09T23:51:59Z","exploitedKev":false,"fixedVersion":"0.3.6","vulnerableRange":"<= 0.3.5"},{"id":"GHSA-vv4j-m4vr-f3g6","title":"ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces","aliases":["CVE-2026-59177"],"summary":"## Summary\n\nOn the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding `0.0.0.0`. The add-on runs in host network mode for mDNS, so binding all interfaces als","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"esphome-device-builder","publishedAt":"2026-09-09T23:51:25Z","exploitedKev":false,"fixedVersion":"1.0.10","vulnerableRange":"< 1.0.10"},{"id":"GHSA-wcjj-9m6g-2fr2","title":"functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import","aliases":["CVE-2026-59176"],"summary":"## MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import\n\n### Summary\n\nThe `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string, interpolates it directly into an npm package specifier (`functype@<v","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"functype-mcp-server","publishedAt":"2026-09-09T23:49:20Z","exploitedKev":false,"fixedVersion":"1.4.4","vulnerableRange":"<= 1.4.3"},{"id":"GHSA-m835-3cm9-rggg","title":"Joker linter executed project-local .jokerd\/linter.* files during linting","aliases":["CVE-2026-59172"],"summary":"## Impact\n\nIn Joker versions before 1.8.2, `joker --lint <file>` located a `.jokerd\/` directory by walking up from the linted file and executed matching `linter.*` files from that directory before linting. Because these files are executable Joker\/Clojure code, linting a file insi","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/candid82\/joker","publishedAt":"2026-09-09T23:48:46Z","exploitedKev":false,"fixedVersion":"1.8.2","vulnerableRange":"< 1.8.2"},{"id":"GHSA-hxjg-93wc-h8p8","title":"Komari: Management Interface CSRF","aliases":[],"summary":"# Vulnerability Overview\n\nThe `session_token` cookie is set **without** the `SameSite` or `Secure` attributes (`login.go:68`).\n\nAll `\/api\/admin\/` management endpoints rely solely on this cookie for authentication, with **no CSRF token or Origin validation**.\n\n**The server-side vu","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/komari-monitor\/komari","publishedAt":"2026-09-09T23:48:31Z","exploitedKev":false,"fixedVersion":"0.0.0-20260609084633-98122fa4d110","vulnerableRange":"< 0.0.0-20260609084633-98122fa4d110"},{"id":"GHSA-2r5q-h53f-9rp3","title":"@yeger\/turbo-graph: Unauthenticated Network-Exposed Task Execution via \/api\/run","aliases":["CVE-2026-59160"],"summary":"## Unauthenticated Network-Exposed Turborepo Task Execution via \/api\/run\n\n### Summary\n\n`@yeger\/turbo-graph` starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces (`0.0.0.0:29312` by default). The `\/api\/run` HT","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@yeger\/turbo-graph","publishedAt":"2026-09-09T23:47:55Z","exploitedKev":false,"fixedVersion":"2.8.12","vulnerableRange":"<= 2.8.8"},{"id":"GHSA-fxg7-897c-57mp","title":"Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients","aliases":["CVE-2026-59158"],"summary":"## Public Runtime Config Exposes Ollama API Key to Browser Clients\n\n### Summary\n\n`nuxt-ollama@1.2.26` unconditionally merges all module options \u2014 including `api_key` \u2014 into Nuxt's **public** runtime config (`runtimeConfig.public.ollama`). Nuxt serializes `runtimeConfig.public` in","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nuxt-ollama","publishedAt":"2026-09-09T23:47:44Z","exploitedKev":false,"fixedVersion":"1.3.1","vulnerableRange":">= 1.2.26 < 1.3.1"},{"id":"GHSA-7w5x-hrqm-74c2","title":"smol-toml: Denial of Service via malformed TOML documents","aliases":["CVE-2026-85730"],"summary":"### Summary\n`parse()` can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline (i.e. the comment \"ends\" the document).\n\nThe library fails to exit an internal loop when attempting to find the end of the ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"smol-toml","publishedAt":"2026-09-09T18:07:11Z","exploitedKev":false,"fixedVersion":"1.7.1","vulnerableRange":"<= 1.7.0"},{"id":"GHSA-rw58-wc66-99g4","title":"Duplicate Advisory: GitPython 3.1.59: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle","aliases":["CVE-2026-87818"],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-whh4-5q6c-9v3x. This link is maintained to preserve external references.\n\n## Original Description\nGitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowin","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-09-09T12:32:15Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.1.59 < 3.1.60"},{"id":"GHSA-2pxq-5vcg-rq29","title":"Duplicate Advisory: Repository content can impersonate the git directory, leading to arbitrary code execution","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-239g-whfq-7xj9. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.60 fails to properly validate the git directory location, allowing atta","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-09-09T12:32:15Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.59"},{"id":"GHSA-qpf5-3wfw-fh7q","title":"Duplicate Advisory: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex \u2014 commit author\/committer field parsing","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-g5vv-9gxw-82hx. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.60 contains a regular expression denial of service vulnerability in Act","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-09-09T12:32:15Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.59"},{"id":"GHSA-2x7j-588g-ccc2","title":"Nodemailer: Quadratic (O(n\u00b2)) time complexity in addressparser allows remote denial of service via a crafted address list","aliases":[],"summary":"### Summary\n\nNodemailer's address parser (`lib\/addressparser\/index.js`) parses a list of comma\u2011separated addresses in **quadratic time \u2014 O(n\u00b2)** in the number of addresses. A single crafted address string (e.g. a `To`, `Cc`, `Bcc`, `From`, or `Reply\u2011To` value, or any value passed","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nodemailer","publishedAt":"2026-09-08T21:33:17Z","exploitedKev":false,"fixedVersion":"9.1.0","vulnerableRange":"< 9.1.0"},{"id":"GHSA-2q42-4q24-7rgv","title":"OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML\/JSON outside the output tree","aliases":[],"summary":"### Summary\n\nThe `@typespec\/openapi3` emitter retains the value of a `@versioned` enum member and interpolates it into the output filename as `{version}` without sanitizing path separators or traversal components. The completed path reaches the compiler's `emitFile()`, which crea","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@typespec\/openapi3","publishedAt":"2026-09-08T21:31:09Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 1.15.0"},{"id":"GHSA-wc9g-mqfw-jrwm","title":"multer vulnerable to Denial of Service via crafted multipart field names","aliases":["CVE-2026-77078"],"summary":"### Impact\n\nA vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single `multipart\/form-data` request. Two specially crafted text field names cause an uncaught `RangeError: Invalid array length` inside multer's field parsing, whi","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"multer","publishedAt":"2026-09-08T21:30:20Z","exploitedKev":false,"fixedVersion":"2.3.0","vulnerableRange":"< 2.3.0"},{"id":"GHSA-qfvm-cv95-jqjf","title":"multer vulnerable to Denial of Service via file descriptor leak on aborted uploads","aliases":["CVE-2026-77037"],"summary":"### Impact\n\nA vulnerability in multer `2.2.0` allows an attacker to trigger a Denial of Service (DoS) by aborting or truncating multipart uploads. When using `diskStorage`, the destination write stream is not closed if the upload is aborted before it finishes, so each failed requ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"multer","publishedAt":"2026-09-08T21:29:51Z","exploitedKev":false,"fixedVersion":"2.3.0","vulnerableRange":"= 2.2.0"},{"id":"GHSA-535w-7cp7-47q4","title":"multer vulnerable to Denial of Service via oversized array index in field names","aliases":["CVE-2026-82333"],"summary":"### Impact\n\nmulter is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The `append-field` dependency parses bracket notation in field names, and a large numeric index such as `items[4294967294]` forces allocation of a maximum-length spar","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"multer","publishedAt":"2026-09-08T21:28:43Z","exploitedKev":false,"fixedVersion":"2.3.0","vulnerableRange":"< 2.3.0"},{"id":"GHSA-96p9-rh4f-92cf","title":"Windows ML CLI: CORS misconfig enables localhost RCE","aliases":["CVE-2026-84452"],"summary":"Case Description:\n\nMSRC Notes: Attachments: 1 file(s) attached (1 mp4) Summary: The vulnerability lies in the 'serve\/cli_api.py' component of the 'winml-cli' project, which exposes all winml CLI commands over HTTP without authentication. Although it binds to localhost by default,","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"winml-cli","publishedAt":"2026-09-08T21:27:59Z","exploitedKev":false,"fixedVersion":"0.4.0","vulnerableRange":"< 0.4.0"},{"id":"GHSA-65fr-j4p9-vc33","title":"mongodb: Reject \".\" and NUL bytes in database and collection names","aliases":["CVE-2026-81525"],"summary":"### Impact\nPassing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.\n\n### Patches\nFixed in PHP library 1.21.4 and 2.4.1.\n\n### Workarounds\nValidate database and collection names prior to passing into","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"mongodb\/mongodb","publishedAt":"2026-09-08T21:27:42Z","exploitedKev":false,"fixedVersion":"1.21.4","vulnerableRange":"< 1.21.4"},{"id":"GHSA-26w7-cxv4-gfx2","title":"Astro: Remote code execution through AVIF image optimization","aliases":[],"summary":"A vulnerability in `libheif`, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized.\n\nProjects are affected when an attacker can cause Astro to process an untrusted AVIF image.\n\nThe fix was released in Astro 7","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"astro","publishedAt":"2026-09-08T21:26:16Z","exploitedKev":false,"fixedVersion":"7.2.8","vulnerableRange":"< 7.2.8"},{"id":"GHSA-rvx4-ffvw-m9q3","title":"Composer arbitrary command execution via a malicious package's Perforce source URL","aliases":["CVE-2026-84361"],"summary":"## Summary\n\nIf the `p4` Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs (packagist.org is safe) could execute arbitrary commands when running `composer install` or `composer update`. Composer passe","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"composer\/composer","publishedAt":"2026-09-08T21:25:41Z","exploitedKev":false,"fixedVersion":"2.10.3","vulnerableRange":">= 2.3.0 < 2.10.3"},{"id":"GHSA-rgj7-g3m4-5g8c","title":"sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545","aliases":[],"summary":"### Impact\nA number of vulnerabilities, two rated as \"Critical\" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution (RCE) on glibc-based Linux when run under certain conditions.\n\nThe attack vec","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"sharp","publishedAt":"2026-09-08T21:25:11Z","exploitedKev":false,"fixedVersion":"0.35.4","vulnerableRange":"< 0.35.4"},{"id":"GHSA-2883-xcg3-v3hh","title":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","aliases":["CVE-2026-84375"],"summary":"## Summary\n\n`maxTotalMergeKeys` does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit.\n\n## Example\n\n```yaml\narr: &arr [{}, {}, {}, ...] # N empty mappings\ntargets:\n  - <<: *arr   ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"js-yaml","publishedAt":"2026-09-08T21:24:51Z","exploitedKev":false,"fixedVersion":"4.3.2","vulnerableRange":">= 4.0.0 < 4.3.2"},{"id":"GHSA-j95f-988m-3j2f","title":"Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing","aliases":[],"summary":"## Summary\n\n`@tiptap\/core` contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated `__QUOTED_0` prefixes. Inline shortcode attributes use ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@tiptap\/core","publishedAt":"2026-09-08T21:24:09Z","exploitedKev":false,"fixedVersion":"3.30.5","vulnerableRange":">= 3.7.0 < 3.30.5"},{"id":"GHSA-2v4p-qf9q-27wj","title":"gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers","aliases":["CVE-2026-84445"],"summary":"A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:authority` and `Host` headers can cause a server panic, resulting in a Denial of Service (DoS).\n\nServers built with `xds.NewGRPCServer` install an xDS routing in","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"google.golang.org\/grpc","publishedAt":"2026-09-08T21:21:43Z","exploitedKev":false,"fixedVersion":"1.82.2","vulnerableRange":"< 1.82.2"},{"id":"GHSA-2xp9-vwfh-vxw4","title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used","aliases":[],"summary":"A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.\n\nUntil a fix has propagated, optimization of AVIF files is disabled.","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"next","publishedAt":"2026-09-08T21:21:12Z","exploitedKev":false,"fixedVersion":"15.5.24","vulnerableRange":">= 10.0.0 < 15.5.24"},{"id":"GHSA-w27v-7q3p-w38r","title":"SVGO: removeScripts allows executable links through namespace and control-character bypasses","aliases":["CVE-2026-84370"],"summary":"## Summary\n\nSVGO's opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input c","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"svgo","publishedAt":"2026-09-08T21:20:28Z","exploitedKev":false,"fixedVersion":"2.8.4","vulnerableRange":">= 1.0.0 < 2.8.4"},{"id":"GHSA-c7q8-3ch8-vqpv","title":"xmldom: Processing Instruction Target Injection Bypasses requireWellFormed","aliases":["CVE-2026-83616"],"summary":"## Summary\n\n`Document.createProcessingInstruction()` in `@xmldom\/xmldom` performs no validation on the `target` parameter. The `requireWellFormed: true` serializer option validates only for `:` in the target and a case-insensitive `xml` prefix, but does not check for `>` characte","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T21:03:28Z","exploitedKev":false,"fixedVersion":"0.8.15","vulnerableRange":">= 0.7.0 <= 0.8.14"},{"id":"GHSA-jxjr-3g7g-3944","title":"xmldom: requireWellFormed element\/attribute name validation is bypassable via an embedded line terminator","aliases":["CVE-2026-83617"],"summary":"## Summary\n\nAn embedded line terminator bypasses the `requireWellFormed` serializer check for element and\nattribute names. The check was added to fix GHSA-w2rr-34g9-rvrj and GHSA-4w3w-2rp5-g8jm; a name whose\nfirst line is well-formed slips past it and is serialized verbatim, so t","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T21:03:17Z","exploitedKev":false,"fixedVersion":"0.9.12","vulnerableRange":"= 0.9.11"},{"id":"GHSA-27p8-2357-5qqv","title":"xmldom: DocType `name` Injection Bypasses requireWellFormed","aliases":["CVE-2026-83608"],"summary":"## Summary\n\nThe `@xmldom\/xmldom` serializer emits `DocumentType.name` verbatim into the\n`<!DOCTYPE \u2026>` declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h\n(CVE-2026-41674) hardened the serializer's `requireWellFormed` path for a\nDocumentType's sibling fields \u2014 `publicI","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T21:02:51Z","exploitedKev":false,"fixedVersion":"0.8.15","vulnerableRange":">= 0.7.0 <= 0.8.14"},{"id":"GHSA-3px3-54cx-rmw9","title":"xmldom: Creation-time XML Name\/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path","aliases":["CVE-2026-83609"],"summary":"## Summary\n\nAn embedded line terminator bypasses xmldom's always-on, WHATWG-mandated creation-time name\nvalidation. `createElementNS`, `createAttributeNS`, `createDocumentType`, and `createAttribute` should\nreject a malformed qualified name with `InvalidCharacterError`, but a nam","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T21:02:33Z","exploitedKev":false,"fixedVersion":"0.9.12","vulnerableRange":">= 0.9.0 <= 0.9.11"},{"id":"GHSA-vr34-hp96-76pp","title":"xmldom: requireWellFormed DocType publicId\/systemId validation is bypassable via an embedded line terminator","aliases":["CVE-2026-83618"],"summary":"## Summary\n\nAn embedded line terminator bypasses the `requireWellFormed` serializer check for a `DocumentType`'s\npublicId and systemId. The check was added to fix GHSA-f6ww-3ggp-fr8h; an id whose first line is a\nvalid literal slips past it and is emitted verbatim into the `<!DOCT","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T21:02:25Z","exploitedKev":false,"fixedVersion":"0.9.12","vulnerableRange":">= 0.9.10 <= 0.9.11"},{"id":"GHSA-8344-3jmq-59r6","title":"xmldom: Quadratic-time attribute deduplication","aliases":["CVE-2026-83613"],"summary":"## Summary\n\nxmldom builds the attribute collection of every parsed element by inserting attributes one at a\ntime into a DOM `NamedNodeMap`. Each insertion first performs a **linear scan of all\nalready-inserted attributes** to enforce the DOM uniqueness rule (no two attributes wit","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T21:01:31Z","exploitedKev":false,"fixedVersion":"0.8.15","vulnerableRange":">= 0.7.0 <= 0.8.14"},{"id":"GHSA-x4fp-j954-r2f4","title":"xmldom: End-tag Whitespace-Trim Regex ReDoS \u2014 quadratic backtracking in the 0.8.x end-tag parser","aliases":["CVE-2026-83619"],"summary":"## Summary\n\nOn the `@xmldom\/xmldom` **`0.8.x`** line, parsing an XML end tag whose name is followed by a long run\nof whitespace and then a non-whitespace character triggers quadratic-time regular-expression\nbacktracking (ReDoS), so a single small crafted end tag stalls the Node.j","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T21:01:09Z","exploitedKev":false,"fixedVersion":"0.8.15","vulnerableRange":">= 0.7.0 <= 0.8.14"},{"id":"GHSA-965w-775f-mr7g","title":"xmldom: Quadratic-memory consumption","aliases":["CVE-2026-83615"],"summary":"## Summary\n\nWhen an element declares a namespace prefix, xmldom copies the entire in-scope namespace map\ninto a fresh object and keeps that copy on the element while it is open on the parse stack. A\ncrafted document that nests N elements, each declaring one unique prefix, therefo","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T21:00:52Z","exploitedKev":false,"fixedVersion":"0.8.15","vulnerableRange":">= 0.7.0 <= 0.8.14"},{"id":"GHSA-93r5-fhx6-vmg9","title":"xmldom: Quadratic-time parsing via the malformed-input recovery path \u2014 `parseElementStartPart` re-scan and `normalize()` adjacent-text merge","aliases":["CVE-2026-83614"],"summary":"## Summary\n\n`xmldom`'s malformed-input **error-recovery path** has two quadratic-time (O(n\u00b2)) behaviors that a\nsingle crafted input triggers together, so a tiny, highly compressible document (tens of KB) stalls\nthe Node.js event loop for multiple seconds. It is reachable from `DO","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T21:00:41Z","exploitedKev":false,"fixedVersion":"0.8.15","vulnerableRange":">= 0.7.0 <= 0.8.14"},{"id":"GHSA-6mj3-qw4j-hgrw","title":"xmldom: HTML raw-text closing-tag case mismatch causes output amplification","aliases":["CVE-2026-83612"],"summary":"## Summary\n\nIn HTML mode (`text\/html`), a raw-text element (`script`, `style`, `textarea`, `title`) whose closing\ntag differs in case from its opening tag (e.g. `<\/ScRiPt>` for `<script>`) is mishandled by the\nparser, producing quadratic (O(n\u00b2)) output growth \u2014 a small crafted do","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T20:59:54Z","exploitedKev":false,"fixedVersion":"0.9.12","vulnerableRange":">= 0.9.0-beta.1 <= 0.9.11"},{"id":"GHSA-w6f5-v2h6-g786","title":"Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections","aliases":["CVE-2026-84372"],"summary":"### Summary\n\nAn improper CRLF neutralization flaw in Predis' pipeline handling on\naggregate connections lets an unauthenticated attacker who can influence any\npipelined argument \u2014 a value **or** a key, e.g. a URL slug used as a cache key \u2014\nsmuggle arbitrary Redis commands into th","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"predis\/predis","publishedAt":"2026-09-08T20:57:50Z","exploitedKev":false,"fixedVersion":"3.3.0","vulnerableRange":">= 3.0.0-RC1 < 3.3.0"},{"id":"GHSA-fxf7-vhh8-7vpq","title":"CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver","aliases":["CVE-2026-77635"],"summary":"### Impact\nThe `FunctionsBuilder::jsonValue($field, $jsonPath)` methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the `$jsonPath` parameter.\n\n### Patches\n5.1.10, 5.2.15, 5.3.7 \n\n### Workarounds\nDon't provide user controlled dat","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"cakephp\/cakephp","publishedAt":"2026-09-08T20:56:41Z","exploitedKev":false,"fixedVersion":"5.3.7","vulnerableRange":">= 5.3.0 < 5.3.7"},{"id":"GHSA-2qh5-382h-3jpc","title":"CakePHP: SmtpTransport vulnerable to CRLF header injection","aliases":["CVE-2026-77634"],"summary":"### Impact\n\nCustom mail headers added with `Message::setHeaders()` or `addHeaders()` do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.\n\n### Patches\n5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixe","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"cakephp\/cakephp","publishedAt":"2026-09-08T20:56:26Z","exploitedKev":false,"fixedVersion":"4.5.12","vulnerableRange":">= 4.5.0 < 4.5.12"},{"id":"GHSA-p293-qw3h-jr36","title":"Next.js: Unauthenticated Remote Code Execution on windows-hosted servers","aliases":["CVE-2026-75604"],"summary":"## Impact\n\nA vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.\n\n## Workaround\n\nThere is no known workaround for affected windows-hosted applications.","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"next","publishedAt":"2026-09-08T20:51:40Z","exploitedKev":false,"fixedVersion":"15.5.24","vulnerableRange":">= 13.4.0 < 15.5.24"},{"id":"GHSA-jrc7-96c5-q579","title":"MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip","aliases":["CVE-2026-85061"],"summary":"### Impact\n`DOM.sanitize()` in `src\/util\/dom.ts` iterated `elem.attributes` (a live `NamedNodeMap`) while calling `elem.removeAttribute()` in the same loop. Removing an attribute shifts subsequent attributes down by one index, causing the iterator to skip the adjacent attribute.\n","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"maplibre-gl","publishedAt":"2026-09-08T20:50:47Z","exploitedKev":false,"fixedVersion":"6.4.1","vulnerableRange":"<= 6.4.0"},{"id":"GHSA-8xx6-hgc6-gc2m","title":"HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)","aliases":["CVE-2026-84382"],"summary":"### Summary\n\nWhen decoding a compressed response body (`gzip`, `deflate`, `br`, or `zstd`), HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"httpx2","publishedAt":"2026-09-08T20:48:59Z","exploitedKev":false,"fixedVersion":"2.12.0","vulnerableRange":"< 2.12.0"},{"id":"GHSA-7mj9-2mp8-4m2p","title":"HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies","aliases":["CVE-2026-84381"],"summary":"### Summary\n\nhttpcore2 does not start TLS for `wss:\/\/` connections routed through a SOCKS5 proxy. The WebSocket opening handshake and all subsequent frames are sent in plaintext through the proxy path, despite the caller selecting the secure `wss` scheme.\n\nThe transport flaw affe","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"httpcore2","publishedAt":"2026-09-08T20:45:18Z","exploitedKev":false,"fixedVersion":"2.10.0","vulnerableRange":"< 2.10.0"},{"id":"GHSA-c7r6-vx3h-w5g2","title":"Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path","aliases":["CVE-2026-84374"],"summary":"### Summary\n\n`Excel::store()` resolved the destination path against the process working\ndirectory rather than the configured filesystem disk. When that path resolved to\nan existing file, the export was written straight to it with `fopen()`,\nbypassing the disk entirely. An applica","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"maatwebsite\/excel","publishedAt":"2026-09-08T20:40:47Z","exploitedKev":false,"fixedVersion":"3.1.70","vulnerableRange":">= 3.1.8 < 3.1.70"},{"id":"GHSA-g53g-w8rj-fmg7","title":"xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions","aliases":["CVE-2026-83606"],"summary":"## Summary\n\n`@xmldom\/xmldom`'s processing-instruction (PI) grammar regex exhibits quadratic-time backtracking\n(ReDoS) when parsing an **unterminated** processing instruction. A single small XML document\ncontaining `<?` + a target + a long run of whitespace and no closing `?>` for","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T20:31:50Z","exploitedKev":false,"fixedVersion":"0.9.11","vulnerableRange":">= 0.9.0-beta.9 <= 0.9.10"},{"id":"GHSA-w2rr-34g9-rvrj","title":"xmldom: Element name injection via createElement() bypasses requireWellFormed","aliases":["CVE-2026-83607"],"summary":"## Summary\n\n`Document.createElement()` in `@xmldom\/xmldom` accepts arbitrary strings as the `tagName` parameter with zero validation. The serializer emits the tag name verbatim into XML\/HTML output. Critically, the `requireWellFormed: true` serializer option \u2014 the recommended mit","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T20:31:08Z","exploitedKev":false,"fixedVersion":"0.9.11","vulnerableRange":">= 0.9.0 <= 0.9.10"},{"id":"GHSA-4w3w-2rp5-g8jm","title":"xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed","aliases":["CVE-2026-83605"],"summary":"## Summary\n\n`Element.setAttribute()` in `@xmldom\/xmldom` bypasses attribute name validation by calling the private `_createAttribute(name)` method, which performs no validation. The public `createAttribute()` method correctly validates names against an anchored `QName` pattern, b","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@xmldom\/xmldom","publishedAt":"2026-09-08T20:30:51Z","exploitedKev":false,"fixedVersion":"0.9.11","vulnerableRange":">= 0.9.0 <= 0.9.10"},{"id":"GHSA-w3v8-gmh9-3wv7","title":"NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions","aliases":["CVE-2026-80206"],"summary":"### Summary\nThe NLTK `tgrep` module accepts user-supplied regular expressions and passes them to the Python `re` engine without a timeout or validation, enabling catastrophic backtracking (ReDoS). Applications that expose the `tgrep` API to external input are vulnerable to a sing","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-08T20:28:28Z","exploitedKev":false,"fixedVersion":"3.10.3","vulnerableRange":"<= 3.10.2"},{"id":"GHSA-rrv8-h7p8-rx55","title":" NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions","aliases":["CVE-2026-80205"],"summary":"### Summary\nNLTK's `Text.findall()` and `TokenSearcher.findall()` methods accept user-supplied regular expressions and pass them to the Python `re` engine without timeout or validation, enabling catastrophic backtracking (ReDoS). This issue is isolated to the `nltk.text` module a","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-08T20:28:13Z","exploitedKev":false,"fixedVersion":"3.10.0","vulnerableRange":"<= 3.9.4"},{"id":"GHSA-8mcc-hrx5-hvxc","title":"GitPython: clone_from()\/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination","aliases":["CVE-2026-78677"],"summary":"- **CWE:** CWE-73 (External Control of File Name or Path) \/ CWE-22 (Path Traversal, in the \"escapes intended base directory\" sense)\n- **Affected component:** `git\/repo\/base.py`, `Repo.unsafe_git_clone_options` (class attribute, lines 153-165) and `Repo._clone()` (lines 1477-1520)","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-09-08T18:41:52Z","exploitedKev":false,"fixedVersion":"3.1.59","vulnerableRange":"<= 3.1.58"},{"id":"GHSA-284h-m62q-gf8w","title":"GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE","aliases":["CVE-2026-78676"],"summary":"- **CWE:** CWE-88 (Argument Injection) \/ CWE-94 (Code Injection) \u2014 via a read-then-corrupt-on-rewrite config round trip, not a direct setter argument\n- **Affected component:** `git\/config.py` \u2014 `GitConfigParser._read()` (multi-line value decoding, lines 444-541, esp. `string_deco","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-09-08T18:39:40Z","exploitedKev":false,"fixedVersion":"3.1.59","vulnerableRange":"<= 3.1.58"},{"id":"GHSA-7833-fr7j-v32q","title":"GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)","aliases":["CVE-2026-78675"],"summary":"# [HIGH] Arbitrary local file content disclosure via `[include]` directive in untrusted `.gitmodules` (`SubmoduleConfigParser` never disables `merge_includes`)\n\n- **CWE:** CWE-200 (Exposure of Sensitive Information) \/ CWE-73 (External Control of File Name or Path)\n- **Affected co","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-09-08T18:38:51Z","exploitedKev":false,"fixedVersion":"3.1.59","vulnerableRange":"<= 3.1.58"},{"id":"GHSA-8m2g-8cgm-3vcp","title":"DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API","aliases":["CVE-2026-82533"],"summary":"DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP control-plane API that allows attackers to gain full agent control by supplying a spoofed Host header, as the server validates only the client-supplied Host header value rather","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@deepseek-ai\/dsh-client-connection","publishedAt":"2026-09-08T18:32:01Z","exploitedKev":false,"fixedVersion":"0.1.2-alpha.1","vulnerableRange":"< 0.1.2-alpha.1"},{"id":"GHSA-4r6h-5v86-94p3","title":"LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process","aliases":["CVE-2026-69222"],"summary":"### Summary\n\nThe `join` filter (`src\/filters\/array.ts:8-13`) charges `memoryLimit` by array element **count**, not by the string length it produces, letting a template bypass a configured `memoryLimit` and allocate strings far past budget \u2014 bounded only by V8\/process limits, not ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"liquidjs","publishedAt":"2026-09-08T18:10:35Z","exploitedKev":false,"fixedVersion":"10.27.2","vulnerableRange":"<= 10.27.1"},{"id":"GHSA-xp7j-h7jc-4w8p","title":"Semaphore U: OS Command Injection","aliases":["CVE-2026-73294"],"summary":"# Summary\nAn OS command injection in repository git_url handling lets any user holding the Manager or Owner role on any project (the normal project-collaborator roles) achieve remote code execution on the Semaphore server host. Using git's --upload-pack=<cmd> option, an attacker ","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/semaphoreui\/semaphore","publishedAt":"2026-09-08T17:57:44Z","exploitedKev":false,"fixedVersion":"0.0.0-20260704181911-7e8a9434bd81","vulnerableRange":"< 0.0.0-20260704181911-7e8a9434bd81"},{"id":"GHSA-rcr6-4jqh-j84m","title":"Gitea: Remote Code Execution via diffpatch Git Hook Installation","aliases":["CVE-2026-60004"],"summary":"### Summary\n\nGitea's `diffpatch` endpoint can be abused to install and execute a Git hook from repository-controlled content.\n\nAn attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unau","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"gitea.dev","publishedAt":"2026-09-08T17:56:30Z","exploitedKev":true,"fixedVersion":"1.27.1","vulnerableRange":">= 1.17.0 < 1.27.1"},{"id":"GHSA-v684-q882-jgmq","title":"SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked","aliases":["CVE-2026-72789"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-72789](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-72789).\n\n### Summary\n\n`publishAccess.json` is an opt-out list. The publish gate returns *accessible* for anything not explicitly listed in it. Encrypted notebooks are never writt","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-08T17:56:07Z","exploitedKev":false,"fixedVersion":"0.0.0-20260726020813-a25c2dd06aae","vulnerableRange":"< 0.0.0-20260726020813-a25c2dd06aae"},{"id":"GHSA-3gq4-3j92-5w49","title":"NLTK: Corpus Reader Sandbox Bypass","aliases":["CVE-2026-79674"],"summary":"## Summary\n\nNLTK corpus-reader constructors can still reach outside-root file and database reads before the `nltk.pathsec` sandbox boundary is enforced.\n\nThe PoC shows the safe path blocked by `pathsec.open`, then `LinThesaurusCorpusReader` and `PanLexLiteCorpusReader` succeeding","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-08T16:57:08Z","exploitedKev":false,"fixedVersion":"3.10.3","vulnerableRange":"<= 3.10.2"},{"id":"GHSA-p4rw-rvv2-7xwr","title":"NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement","aliases":["CVE-2026-79676"],"summary":"### Summary\n\nSeveral corpus readers still step outside NLTK's symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in `open()` rather than `nltk.pathsec.open()`.\n\n### Details","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-08T16:55:38Z","exploitedKev":false,"fixedVersion":"3.10.3","vulnerableRange":"<= 3.10.2"},{"id":"GHSA-x99w-6fgc-pmfw","title":"NLTK: Allowlisted pickle loaders still permit code execution in current source","aliases":["CVE-2026-79657"],"summary":"### Summary\n\nThe current source tree still allows arbitrary code execution during supposedly safer allowlisted pickle loading. The allowlist trusts whole module namespaces instead of exact safe globals, so crafted pickles can invoke dangerous in-namespace callables through pickle","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-08T16:42:57Z","exploitedKev":false,"fixedVersion":"3.10.3","vulnerableRange":"<= 3.10.2"},{"id":"GHSA-97qj-x29f-37w7","title":"NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses","aliases":["CVE-2026-78681"],"summary":"Several XML parsing sites in NLTK still used `xml.etree.ElementTree` directly, which honours `<!ENTITY>` declarations in a document's internal DTD subset. A crafted document a few hundred bytes long can expand to megabytes in memory (each nesting level multiplies by ten), a denia","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-08T16:42:18Z","exploitedKev":false,"fixedVersion":"3.10.3","vulnerableRange":"<= 3.10.2"},{"id":"GHSA-6ww7-3frv-cqxh","title":"NLTK: pathsec SSRF protection can be bypassed when a proxy is configured","aliases":["CVE-2026-78682"],"summary":"### Summary\n\nCurrent NLTK source reopens SSRF in proxied environments. `pathsec.urlopen()` validates the requested hostname locally, but once proxy inheritance is enabled the real fetch is performed by the proxy rather than by the validated direct-connect socket path.\n\n### Detail","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-08T16:41:40Z","exploitedKev":false,"fixedVersion":"3.10.3","vulnerableRange":"<= 3.10.2"},{"id":"GHSA-rhp5-r9x4-f5g2","title":"NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution","aliases":["CVE-2026-78683"],"summary":"## Summary\n\nThe NLTK library's `TransitionParser.parse()` method deserializes model files using `pickle_load()` with the default `restricted=False` parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a `RestrictedUnpickler","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-08T16:41:11Z","exploitedKev":false,"fixedVersion":"3.10.0","vulnerableRange":"<= 3.9.4"},{"id":"GHSA-f833-7jw8-xwrv","title":"NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)","aliases":["CVE-2026-62384"],"summary":"This is a **new, distinct vulnerability**: a bypass of the fix already published as [GHSA-xh95-f55m-82fw](https:\/\/github.com\/nltk\/nltk\/security\/advisories\/GHSA-xh95-f55m-82fw) (\"Path traversal in NLTK FramenetCorpusReader.frame() allows arbitrary XML file read, bypassing the nltk","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-08T16:39:24Z","exploitedKev":false,"fixedVersion":"3.10.2","vulnerableRange":">= 3.10.0 < 3.10.2"},{"id":"GHSA-568f-pv23-39p4","title":"NLTK: Stable FrameNet and NKJP readers parse outside-root XML","aliases":["CVE-2026-62385"],"summary":"### Summary\n\nPublished `nltk==3.9.4` still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary.\n\n### Details\n\n- **Vulnerability type:** Path traversal and trust","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-08T16:37:18Z","exploitedKev":false,"fixedVersion":"3.10.0","vulnerableRange":"<= 3.9.4"},{"id":"GHSA-x5ph-mj9p-rfr8","title":"NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read","aliases":["CVE-2026-63312"],"summary":"## Summary\nSetting `nltk.pathsec.ENFORCE = True` is documented to sandbox all file access to allowed NLTK data directories and raise `PermissionError` on unauthorized access. However, `StreamBackedCorpusView` opens files via `builtins.open()` directly, bypassing `pathsec.validate","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-08T15:27:32Z","exploitedKev":false,"fixedVersion":"3.10.0","vulnerableRange":"<= 3.9.4"},{"id":"GHSA-r6gq-whwq-mvg9","title":"NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root","aliases":["CVE-2026-70626"],"summary":"### Summary\n`nltk.corpus.reader.api.CorpusReader.open()` can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and `..` traversal, the current boundary check is only lexical and does not account for s","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-08T15:26:47Z","exploitedKev":false,"fixedVersion":"3.9.4","vulnerableRange":"<= 3.9.3"},{"id":"GHSA-955m-rr6m-2f9v","title":"@sap\/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)","aliases":["CVE-2026-76969"],"summary":"@sap\/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or de","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@sap\/cds-mtxs","publishedAt":"2026-09-08T03:31:13Z","exploitedKev":false,"fixedVersion":"4.0.3","vulnerableRange":">= 4.0.1 < 4.0.3"},{"id":"GHSA-qjrq-cvv4-3g9w","title":"Duplicate Advisory: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools","aliases":[],"summary":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9gfj-28hw-jchp. This link is maintained to preserve external references.\n\n## Original Advisory\n\nknowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"knowns","publishedAt":"2026-09-08T00:30:22Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 0.30.0"},{"id":"GHSA-6ph4-r249-58p2","title":"Duplicate Advisory: knowns vulnerable to command injection","aliases":[],"summary":"# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-mc52-mwq4-vfx3. This link is maintained to preserve external references.\n\n# Original Description\n\nknowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in proj","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"knowns","publishedAt":"2026-09-08T00:30:22Z","exploitedKev":false,"fixedVersion":"0.30.0","vulnerableRange":"< 0.30.0"},{"id":"GHSA-fg72-q65g-wm5w","title":"Duplicate Advisory: H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-q5pr-72pq-83v3. This link is maintained to preserve external references.\n\n## Original Description\nh3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"h3","publishedAt":"2026-09-06T12:30:23Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 2.0.0-beta.4 < 2.0.1-rc.18"},{"id":"GHSA-7q9c-hpx7-9cwm","title":"TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST \/.admin\/stop","aliases":[],"summary":"### Summary\n\n`@typespec\/spector` registers a `POST \/.admin\/stop` HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Becau","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@typespec\/spector","publishedAt":"2026-09-04T21:43:13Z","exploitedKev":false,"fixedVersion":"0.1.0-alpha.27","vulnerableRange":"<= 0.1.0-alpha.26"},{"id":"GHSA-rh53-xvx2-j327","title":"OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only \u2014 data-plane Secret disclosure and arbitrary Kubernetes mutation","aliases":["CVE-2026-73842"],"summary":"### Summary\n\nThe OpenChoreo control-plane cluster-gateway exposes internal management APIs (`\/api\/proxy\/`, `\/api\/exec\/`, `\/api\/wirelogs\/`) that tunnel requests through to connected data planes' Kubernetes APIs, but the internal listener authenticates no caller. Its request valida","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/openchoreo\/openchoreo","publishedAt":"2026-09-04T21:41:38Z","exploitedKev":false,"fixedVersion":"1.0.3","vulnerableRange":"< 1.0.3"},{"id":"GHSA-h4v5-crx2-3cv4","title":"SiYuan: Non-administrator responses from \/api\/system\/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers","aliases":["CVE-2026-72793"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-72793](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-72793).\n\n### Summary\n\n`\/api\/system\/getConf` is registered with `CheckAuth` only and is reachable by the publish `RoleReader` token, and anonymously when `Publish.Auth.Enable` is ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-04T21:16:48Z","exploitedKev":false,"fixedVersion":"0.0.0-20260725132049-2d8b98395a91","vulnerableRange":"< 0.0.0-20260725132049-2d8b98395a91"},{"id":"GHSA-h6w7-xxcf-w2mq","title":"SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers","aliases":["CVE-2026-72795"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-72795](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-72795).\n\n### Summary\n\n`\/api\/block\/getBlockDOMWithEmbed` and `\/api\/block\/getBlockDOMsWithEmbed` gate only the *requested* block against publish access. The blocks pulled in by tha","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-04T21:13:13Z","exploitedKev":false,"fixedVersion":"0.0.0-20260725125659-1ca1c3c9d94b","vulnerableRange":"< 0.0.0-20260725125659-1ca1c3c9d94b"},{"id":"GHSA-34fj-mwm6-fjfg","title":"SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by \/api\/system\/getConf","aliases":["CVE-2026-72794"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-72794](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-72794).\n\n### Summary\n\n`\/api\/system\/getConf` returns `Conf.CookieKey`, the key used to sign the server's session cookies in its response body. The endpoint is registered with `Che","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-04T21:12:26Z","exploitedKev":false,"fixedVersion":"0.0.0-20260725123945-77421530be4a","vulnerableRange":"< 0.0.0-20260725123945-77421530be4a"},{"id":"GHSA-mfrj-v65r-979c","title":"SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns","aliases":["CVE-2026-72798"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-72798](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-72798).\n\n### Summary\n\n`renderAttributeView` correctly applies the reader publish-access filter, but the filter's row-accessibility decision is keyed solely to the row's **first c","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-04T20:58:04Z","exploitedKev":false,"fixedVersion":"0.0.0-20260724121519-426991d155c0","vulnerableRange":"< 0.0.0-20260724121519-426991d155c0"},{"id":"GHSA-848m-r628-vrxw","title":"SurrealDB: Custom API route lets authenticated callers override namespace\/database scope via URL path","aliases":["CVE-2026-63735"],"summary":"An authenticated user scoped to one namespace\/database could invoke a custom API (`DEFINE API`) belonging to a different namespace\/database, reaching another tenant's endpoint.\n\nThe route `\/api\/{namespace}\/{database}\/{endpoint}` took the namespace and database from the URL and ap","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"surrealdb","publishedAt":"2026-09-04T20:07:07Z","exploitedKev":false,"fixedVersion":"3.2.0","vulnerableRange":"< 3.2.0"},{"id":"GHSA-gx45-xrj5-g6c4","title":"CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository","aliases":["CVE-2026-75911"],"summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"deepseek-tui","publishedAt":"2026-09-04T18:14:09Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.8.6 <= 0.8.41"},{"id":"GHSA-wrj3-vj8c-784f","title":"CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)","aliases":["CVE-2026-75858"],"summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"deepseek-tui","publishedAt":"2026-09-04T18:12:15Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.8.33 <= 0.8.41"},{"id":"GHSA-c6mw-8xh8-gpq6","title":"CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval","aliases":["CVE-2026-75912"],"summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"deepseek-tui","publishedAt":"2026-09-04T18:11:45Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.3.27 <= 0.8.41"},{"id":"GHSA-6v2g-fpxh-pmmh","title":"CodeWhale: SSRF\u200c bypass - TOCTOU on DNS failure for DNS pinning","aliases":["CVE-2026-75856"],"summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original","severity":"critical","sourceId":"github-advisories","ecosystem":"cargo","packageName":"deepseek-tui","publishedAt":"2026-09-04T18:05:12Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.8.5 <= 0.8.41"},{"id":"GHSA-h539-c7r8-3xq4","title":"CodeWhale: js_execution leaks parent environment to model context via missing env scrub","aliases":["CVE-2026-75915"],"summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"deepseek-tui","publishedAt":"2026-09-04T18:03:08Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.8.32 <= 0.8.41"},{"id":"GHSA-7j5w-7r7x-9v27","title":"CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval","aliases":["CVE-2026-75913"],"summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"deepseek-tui","publishedAt":"2026-09-04T18:02:37Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.3.27 <= 0.8.41"},{"id":"GHSA-g29h-pfmp-qp9r","title":"CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)","aliases":["CVE-2026-75857"],"summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"deepseek-tui","publishedAt":"2026-09-04T18:02:10Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.3.10 <= 0.8.41"},{"id":"GHSA-62f5-cp2p-vq95","title":"CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository","aliases":["CVE-2026-75859"],"summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"deepseek-tui","publishedAt":"2026-09-04T18:00:37Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.8.8 < 0.8.41"},{"id":"GHSA-w7wx-5q49-r59w","title":"CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes","aliases":["CVE-2026-75914"],"summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"deepseek-tui","publishedAt":"2026-09-04T17:34:55Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.8.32 <= 0.8.41"},{"id":"GHSA-8x84-r2ff-h8pq","title":"SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking","aliases":["CVE-2026-72801"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-72801](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-72801).\n\n### Summary\n\nTwo `CheckAuth`-only endpoints disclose the complete offline attack material for the encrypted-notebook master password, plus the wrapped per-notebook key n","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T23:02:12Z","exploitedKev":false,"fixedVersion":"0.0.0-20260724102025-3bc014c7dc32","vulnerableRange":"< 0.0.0-20260724102025-3bc014c7dc32"},{"id":"GHSA-vpjw-wf5h-cgpq","title":"SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents","aliases":["CVE-2026-72804"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-72804](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-72804).\n\n### Summary\n\n`getGraph` and `getLocalGraph` filter reader sessions against the *visibility* tier only and never check the publish password. Password-protected documents ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T22:52:58Z","exploitedKev":false,"fixedVersion":"0.0.0-20260724091654-82e9ded423e4","vulnerableRange":"< 0.0.0-20260724091654-82e9ded423e4"},{"id":"GHSA-x67c-8pwr-m8g3","title":"SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel","aliases":["CVE-2026-72807"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-72807](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-72807).\n\n### Summary\n\nAttribute-view (AV) template columns are live-evaluated on every render and expose the `queryBlocks` template function, which runs raw SQL on the read-write","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T22:49:30Z","exploitedKev":false,"fixedVersion":"0.0.0-20260723035036-0a176345e02a","vulnerableRange":"< 0.0.0-20260723035036-0a176345e02a"},{"id":"GHSA-3mp7-4rh5-jrv9","title":"SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy","aliases":["CVE-2026-72809"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-72809](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-72809).\n\n### Summary\n\nThe kernel's `CheckAuth` grants `RoleAdministrator` to any request whose `RemoteAddr` is loopback (`127.0.0.1`), for a specific set of endpoints, and these ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T22:34:06Z","exploitedKev":false,"fixedVersion":"0.0.0-20260723031701-9c16e9851f0b","vulnerableRange":"< 0.0.0-20260723031701-9c16e9851f0b"},{"id":"GHSA-mw8r-mw84-88v2","title":"SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected\/forbidden documents (publish mode)","aliases":["CVE-2026-72810"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-72810](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-72810).\n\n### Summary\n\nWebSocket sessions established through the publish surface (port 6808, `RoleReader` anonymous when `Publish.Auth.Enable` is `false`) are added to the same b","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T22:30:52Z","exploitedKev":false,"fixedVersion":"0.0.0-20260723013612-ba948639d7f6","vulnerableRange":"< 0.0.0-20260723013612-ba948639d7f6"},{"id":"GHSA-q2vg-7qgx-x5fc","title":"SiYuan: SQL injection in backlink\/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle","aliases":["CVE-2026-72811"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-72811](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-72811).\n\n### Summary\n\nThe backlink\/mention search query (`kernel\/model\/backlink.go`) concatenates stored block metadata (title, name, alias, anchor text) and the client-supplied ","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T22:27:50Z","exploitedKev":false,"fixedVersion":"0.0.0-20260723004839-1a5b3431d5ab","vulnerableRange":"< 0.0.0-20260723004839-1a5b3431d5ab"},{"id":"GHSA-3qf3-8w2g-rqmx","title":"python-jose algorithm confusion guard bypassed by DER-encoded public keys","aliases":["CVE-2026-85394"],"summary":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not exp","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"python-jose","publishedAt":"2026-09-03T21:31:15Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.5.0"},{"id":"GHSA-86w9-cpqp-85rv","title":"node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements","aliases":["CVE-2026-85393"],"summary":"node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RS","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"node-forge","publishedAt":"2026-09-03T21:31:15Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 1.4.0"},{"id":"GHSA-7j72-f6wg-cxw6","title":"SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM \/ getHeading*Transaction \/ getBacklinkDoc (publish mode)","aliases":["CVE-2026-68584"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-68584](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-68584).\n\n### Summary\n\nSiYuan's publish mode defines a \"protected\" access level: a document that is publicly listed but requires a password to read (per the product's own UI help ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T21:22:42Z","exploitedKev":false,"fixedVersion":"0.0.0-20260721020826-2d069dce84a2","vulnerableRange":"< 0.0.0-20260721020826-2d069dce84a2"},{"id":"GHSA-36v8-mpjm-8j5r","title":"SiYuan: Cross-boundary content disclosure via getBacklinkDoc\/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered","aliases":["CVE-2026-68586"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-68586](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-68586).\n\n### Summary\n\nThe backlink API splits into list endpoints (which documents reference a block) and content endpoints (the rendered text of those referencing blocks). The l","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T21:21:19Z","exploitedKev":false,"fixedVersion":"0.0.0-20260721014413-f45749a7ef6e","vulnerableRange":"< 0.0.0-20260721014413-f45749a7ef6e"},{"id":"GHSA-69mh-gvh4-8gp7","title":"SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check","aliases":["CVE-2026-68587"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-68587](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-68587).\n\n### Summary\n\nThree \"heading transaction\" endpoints `\/api\/block\/getHeadingDeleteTransaction`, `\/api\/block\/getHeadingLevelTransaction`, and `\/api\/block\/getHeadingInsertTra","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T21:19:41Z","exploitedKev":false,"fixedVersion":"0.0.0-20260721013353-69db783b782a","vulnerableRange":"< 0.0.0-20260721013353-69db783b782a"},{"id":"GHSA-fph3-ghq9-vw66","title":"SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB","aliases":["CVE-2026-69083"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-69083](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-69083).\n\n### Summary\n\nThe `\/api\/search\/fullTextSearchAssetContent` endpoint exposes two SQL flaws on the asset-content database, both reachable by the publish `RoleReader` token ","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T21:01:05Z","exploitedKev":false,"fixedVersion":"0.0.0-20260721004815-cf42dd5680c8","vulnerableRange":"< 0.0.0-20260721004815-cf42dd5680c8"},{"id":"GHSA-82x6-q7mm-w9cf","title":"toml-node: Uncontrolled Recursion","aliases":["CVE-2026-77465"],"summary":"### Summary\n\n\n`toml.parse()` crashes with an uncaught `RangeError: Maximum call stack size exceeded` when parsing deeply nested arrays or inline tables. The parser is generated by **Peggy 5.1.0** (a PEG parser generator) as a recursive-descent parser; the value rule mutually recu","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"toml","publishedAt":"2026-09-03T20:56:13Z","exploitedKev":false,"fixedVersion":"4.2.0","vulnerableRange":"< 4.2.0"},{"id":"GHSA-v5mp-jgw5-2x6j","title":"toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization","aliases":["CVE-2026-63376"],"summary":"### Summary\n\n`toml.parse()` writes attacker-controlled keys onto `Object.prototype`. The compiler protects the tables it builds by creating them with `Object.create(null)`, which neutralizes a direct `[__proto__]` table. An attacker bypasses that protection by routing a table pat","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"toml","publishedAt":"2026-09-03T20:55:32Z","exploitedKev":false,"fixedVersion":"4.1.2","vulnerableRange":"< 4.1.2"},{"id":"GHSA-7hm9-v7vf-7g4w","title":"SiYuan: Path Traversal via unvalidated avID in RenderAttributeView\/AV read endpoints : reader-reachable cross-scope attribute-view disclosure","aliases":["CVE-2026-69086"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-69086](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-69086).\n\n### Summary\n\nFour attribute-view read endpoints build a filesystem path from a caller-controlled `id`\/`avID` and read it without confining the result to the attribute-vi","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T20:34:12Z","exploitedKev":false,"fixedVersion":"0.0.0-20260720151813-0f5a0e7c67b0","vulnerableRange":"< 0.0.0-20260720151813-0f5a0e7c67b0"},{"id":"GHSA-vh22-h7hf-www7","title":"SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read\/write","aliases":["CVE-2026-69084"],"summary":"**CVE:** This vulnerability corresponds to [CVE-2026-69084](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-69084).\n\n### Summary\n\nThe `\/api\/search\/searchEmbedBlock` endpoint passes a client-supplied SQL statement verbatim to the database with no validation. The endpoint is gated by `Ch","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T20:19:22Z","exploitedKev":false,"fixedVersion":"0.0.0-20260721002947-23a17d44b5f3","vulnerableRange":"< 0.0.0-20260721002947-23a17d44b5f3"},{"id":"GHSA-6c5v-hqjr-5xxp","title":"amqp091-go has a Potential Memory Exhaustion\/Protocol Violation via Broker-Controlled Oversized Payload","aliases":["CVE-2026-79921"],"summary":"**Summary**\nA vulnerability exists in the amqp091-go client library where a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumpti","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rabbitmq\/amqp091-go","publishedAt":"2026-09-03T20:15:13Z","exploitedKev":false,"fixedVersion":"1.13.0","vulnerableRange":"< 1.13.0"},{"id":"GHSA-p95v-992w-h6c3","title":"TOON: Prototype pollution when decoding untrusted TOON input","aliases":["CVE-2026-82404"],"summary":"### Summary\n\nDecoding attacker-controlled TOON containing a `__proto__`, `constructor`, or `prototype` key wrote through the object's prototype chain instead of creating an own property, polluting `Object.prototype` for the whole runtime. The `expandPaths: 'safe'` path (dotted ke","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@toon-format\/toon","publishedAt":"2026-09-03T19:52:08Z","exploitedKev":false,"fixedVersion":"2.3.1","vulnerableRange":"< 2.3.1"},{"id":"GHSA-79wm-x847-7cvg","title":"Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)","aliases":["CVE-2026-73222"],"summary":"### Summary\n`npx claude-code-templates --studio` launches \"Claude Code Studio\", an Express HTTP server (`cli-tool\/src\/sandbox-server.js`, default port 3444) that binds to **all interfaces** (`0.0.0.0`), sets `Access-Control-Allow-Origin: *`, and requires **no authentication**. Tw","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"claude-code-templates","publishedAt":"2026-09-03T19:50:47Z","exploitedKev":false,"fixedVersion":"1.29.4","vulnerableRange":"<= 1.29.2"},{"id":"GHSA-cxvf-gvfq-36w2","title":"Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision","aliases":["CVE-2026-73293"],"summary":"## Summary\n\nSemaphore resolves a project member's effective permissions in `ProjectMiddleware` by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in `manager` rol","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/semaphoreui\/semaphore","publishedAt":"2026-09-03T19:23:42Z","exploitedKev":false,"fixedVersion":"0.0.0-20260705182501-bb2a4e1f08c8","vulnerableRange":"< 0.0.0-20260705182501-bb2a4e1f08c8"},{"id":"GHSA-8cj9-r88m-8945","title":"Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation","aliases":["CVE-2026-73292"],"summary":"### Summary\n\nThe password change form is vulnerable to CSRF, allowing an attacker to change a user password (even the administrator) by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20.\n\n### Details\n\nThe password chang","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/semaphoreui\/semaphore","publishedAt":"2026-09-03T19:23:15Z","exploitedKev":false,"fixedVersion":"0.0.0-20260707190631-c59c3dc9035b","vulnerableRange":"< 0.0.0-20260707190631-c59c3dc9035b"},{"id":"GHSA-fg9p-mrxr-hvq7","title":"Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)","aliases":["CVE-2026-62681"],"summary":"### Summary\n\nOrval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL (`` `\/users\/...` ``) without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"orval","publishedAt":"2026-09-03T19:17:32Z","exploitedKev":false,"fixedVersion":"8.21.0","vulnerableRange":"< 8.21.0"},{"id":"GHSA-88f2-fpv8-89q2","title":"Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)","aliases":["CVE-2026-62682"],"summary":"### Summary\n\nWhen Orval is configured with `output.baseUrl.getBaseUrlFromSpecification: true`, it bakes the spec's `servers[0].url` into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal a","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"orval","publishedAt":"2026-09-03T19:06:52Z","exploitedKev":false,"fixedVersion":"8.21.0","vulnerableRange":"< 8.21.0"},{"id":"GHSA-w727-8j6c-2rj4","title":"Orval: Import-time RCE via schema default -> zod module-level template literal","aliases":["CVE-2026-72717"],"summary":"### Summary\n\nOrval's zod schema generation emits a schema's `default` value as a module-level template literal (`export const \u2026Default = `<default>`;`) without escaping `${` or the backtick. A default of the form `v${<code>}w` injects a live JavaScript expression that is evaluate","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"orval","publishedAt":"2026-09-03T19:03:03Z","exploitedKev":false,"fixedVersion":"8.21.0","vulnerableRange":"< 8.21.0"},{"id":"GHSA-2h9g-j24r-h63g","title":"Orval: Import-time RCE via array-items default -> zod module-level template literal","aliases":["CVE-2026-71869"],"summary":"### Summary\n\nOrval's zod schema generation emits the **array-items** `default` value as a module-level template literal (`export const \u2026Default = `<default>`;`) without escaping `${` or the backtick. A default of the form `v${<code>}w` injects a live JavaScript expression evaluat","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"orval","publishedAt":"2026-09-03T18:38:20Z","exploitedKev":false,"fixedVersion":"8.21.0","vulnerableRange":"< 8.21.0"},{"id":"GHSA-8j6p-r8jg-mxqh","title":"Orval: Import-time RCE via header-parameter default -> zod module-level template literal","aliases":["CVE-2026-71871"],"summary":"### Summary\n\nOrval's zod schema generation emits the **header-parameter** `default` value as a module-level template literal (`export const Default = `<default>`;`) without escaping `${` or the backtick. A default of the form `v${<code>}w` injects a live JavaScript expression eva","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"orval","publishedAt":"2026-09-03T18:32:03Z","exploitedKev":false,"fixedVersion":"8.21.0","vulnerableRange":"< 8.21.0"},{"id":"GHSA-2w86-xfrc-g85r","title":"Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator","aliases":["CVE-2026-71867"],"summary":"### Summary\n\norval, when generating MSW mocks (output.mock: true), emits each schema property name as a single-quoted object key in the mock factory WITHOUT escaping the single quote. A ' in a property name closes the key and lands in object-literal context, where an injected com","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"orval","publishedAt":"2026-09-03T18:26:12Z","exploitedKev":false,"fixedVersion":"8.21.0","vulnerableRange":"< 8.21.0"},{"id":"GHSA-3575-w9fc-c2j6","title":"Orval: Import-time RCE via enum-typed default -> zod module-level template literal","aliases":["CVE-2026-71868"],"summary":"### Summary\n\nOrval's zod schema generation emits the **enum-typed** `default` value as a module-level template literal (`export const \u2026Default = `<default>`;`) without escaping `${` or the backtick. A default of the form `v${<code>}w` injects a live JavaScript expression evaluate","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"orval","publishedAt":"2026-09-03T18:20:55Z","exploitedKev":false,"fixedVersion":"8.21.0","vulnerableRange":"< 8.21.0"},{"id":"GHSA-653q-5476-x79g","title":"Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli","aliases":["CVE-2026-71865"],"summary":"### Summary\n\norval's zod client emits each query parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A \" in the query parameter name closes the key and lands in object-literal context, where an inje","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"orval","publishedAt":"2026-09-03T18:18:09Z","exploitedKev":false,"fixedVersion":"8.21.0","vulnerableRange":"< 8.21.0"},{"id":"GHSA-6437-gxhq-pqv8","title":"Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client","aliases":["CVE-2026-71864"],"summary":"### Summary\n\norval's zod client emits each header parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A \" in the header parameter name closes the key and lands in object-literal context, where an in","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"orval","publishedAt":"2026-09-03T18:08:31Z","exploitedKev":false,"fixedVersion":"8.21.0","vulnerableRange":"< 8.21.0"},{"id":"GHSA-jcvh-xf52-2cwm","title":"ffuf denial of service (OOM) via HTTP response decompression bomb","aliases":["CVE-2026-73232"],"summary":"### Summary\n\n  A malicious or attacker-controlled target server can crash ffuf with an out-of-memory condition by returning a compressed HTTP response that decompresses to a very large body (a decompression\n  bomb). This works against default usage with no special flags.\n\n  ### D","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/ffuf\/ffuf\/v2","publishedAt":"2026-09-03T18:02:09Z","exploitedKev":false,"fixedVersion":"2.2.0","vulnerableRange":"<= 2.1.0"},{"id":"GHSA-m7fp-h3p4-hr49","title":"LiquidJS has an infinite loop vulnerability in its `strip_html` filter","aliases":["CVE-2026-61556"],"summary":"### Summary\nThe current implementation of `strip_html` can cause an infinite loop when the input string contains `<`, has at least one character before `<`, and no `>` appears after `<`.\n\n### Details\nThe problem is in `src\/filters\/html.ts`.\nSpecifically, the following part has th","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"liquidjs","publishedAt":"2026-09-03T17:45:26Z","exploitedKev":false,"fixedVersion":"10.27.1","vulnerableRange":">= 10.26.0 < 10.27.1"},{"id":"GHSA-w8wf-3qvj-6xqf","title":"OpenClaw Feishu permission tools could ignore per-account disablement","aliases":[],"summary":"### Summary\n\nFeishu permission tools could ignore per-account disablement. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature a","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@openclaw\/feishu","publishedAt":"2026-09-03T17:33:19Z","exploitedKev":false,"fixedVersion":"2026.6.9","vulnerableRange":"< 2026.6.9-beta.1"},{"id":"GHSA-2q7j-2vhx-56g8","title":"OpenClaw Feishu tools could ignore per-account disablement","aliases":[],"summary":"### Summary\n\nFeishu tools could ignore per-account disablement. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configur","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@openclaw\/feishu","publishedAt":"2026-09-03T17:30:55Z","exploitedKev":false,"fixedVersion":"2026.6.9","vulnerableRange":"< 2026.6.9-beta.1"},{"id":"GHSA-4mvj-m6j5-pmf7","title":"unstructured: Server-Side Request Forgery in the URL-based partitioning","aliases":["CVE-2026-71428"],"summary":"### Summary\n\nServer-Side Request Forgery in `unstructured`. The `url=` argument of `partition()`, `partition_html()`, and `partition_md()` is fetched via `requests.get()` with no host validation. The response body is returned as `Element` text, so this is a **full-read SSRF** \u2014 a","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"unstructured","publishedAt":"2026-09-03T17:02:46Z","exploitedKev":false,"fixedVersion":"0.24.0","vulnerableRange":">= 0.4.7 < 0.24.0"},{"id":"GHSA-99rq-75j6-5j9f","title":"SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass","aliases":[],"summary":"### Summary\nSiYuan cleans user supplied SVG with `util.SanitizeSVG` before it serves the file inline as `image\/svg+xml`. This cleaner is the guard behind the `Editor.AllowSVGScript` setting, which is off by default, so a `<script>` inside an SVG is meant to be removed.\n\nThe clean","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-03T14:53:17Z","exploitedKev":false,"fixedVersion":"0.0.0-20260714095344-f08dee71ba8e","vulnerableRange":"< 0.0.0-20260714095344-f08dee71ba8e"},{"id":"GHSA-2mw5-23gm-pccq","title":"OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods","aliases":["CVE-2026-73667"],"summary":"### Summary\nOpenChoreo Workflow Plane templates were vulnerable to OS command injection because some developer-controlled workflow parameters were interpolated directly into shell program text executed through sh -c.\n\nAn authenticated user with permission to configure and trigger","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/openchoreo\/openchoreo","publishedAt":"2026-09-02T23:45:26Z","exploitedKev":false,"fixedVersion":"1.0.4","vulnerableRange":"< 1.0.4"},{"id":"GHSA-52gf-6rpq-fgmx","title":"OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints","aliases":["CVE-2026-73841"],"summary":"### Summary\n\nThe OpenChoreo API server (`openchoreo-api`) authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved b","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/openchoreo\/openchoreo","publishedAt":"2026-09-02T23:44:51Z","exploitedKev":false,"fixedVersion":"1.2.3","vulnerableRange":">= 1.2.0-m.1 < 1.2.3"},{"id":"GHSA-qh9r-j7rp-4x2m","title":"OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs","aliases":["CVE-2026-73843"],"summary":"### Summary\nThe OpenChoreo control-plane **cluster-gateway** served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did ","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/openchoreo\/openchoreo","publishedAt":"2026-09-02T23:43:55Z","exploitedKev":false,"fixedVersion":"1.0.2","vulnerableRange":"< 1.0.2"},{"id":"GHSA-w878-pj84-3j5v","title":"Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection","aliases":["CVE-2026-67445"],"summary":"## Summary\n\nMailpit's SMTP server reads each command line with an unbounded `bufio.Reader.ReadString('\\n')` before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-con","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/axllent\/mailpit","publishedAt":"2026-09-02T23:42:25Z","exploitedKev":false,"fixedVersion":"1.30.4","vulnerableRange":"<= 1.30.3"},{"id":"GHSA-gv5w-hfx8-8cwq","title":"SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths","aliases":["CVE-2026-72921"],"summary":"### Impact\nWhen a filer JWT restricts a token to a set of path prefixes via `allowed_prefixes`, the authorization check used a literal byte-prefix match (`strings.HasPrefix`). A token scoped to `\/tenant1` therefore also authorized requests to sibling paths such as `\/tenant1234`, ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/seaweedfs\/seaweedfs","publishedAt":"2026-09-02T23:42:05Z","exploitedKev":false,"fixedVersion":"0.0.0-20260512171048-05ed5c9ae8a2","vulnerableRange":"< 0.0.0-20260512171048-05ed5c9ae8a2"},{"id":"GHSA-9468-v6mj-fppw","title":"Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends","aliases":["CVE-2026-71485"],"summary":"## Vulnerability Details\n\n**File**: `internal\/client\/handler.go` (`OnClientConnecting`), `internal\/proxy\/http.go` (`requestHeaders`), `internal\/proxy\/grpc.go` (`requestMetadata`), `internal\/unigrpc\/grpc.go` (`Consume`)\n**Line**: handler.go:389,548-552 (`e.Headers` -> `SetEmulated","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/centrifugal\/centrifugo","publishedAt":"2026-09-02T23:41:37Z","exploitedKev":false,"fixedVersion":"6.9.0","vulnerableRange":"<= 6.8.4"},{"id":"GHSA-75mr-qw9x-3r39","title":"Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling","aliases":["CVE-2026-67446"],"summary":"## Summary\n\nMailpit's thumbnail endpoint decodes attacker-supplied image attachments into a full raster before checking any decoded-pixel, dimension, or memory budget. A remote client that can store an email and reach the default web API can supply a compact high-dimension image,","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/axllent\/mailpit","publishedAt":"2026-09-02T23:39:08Z","exploitedKev":false,"fixedVersion":"1.30.4","vulnerableRange":"<= 1.30.3"},{"id":"GHSA-76g3-c3x4-crvx","title":"Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default","aliases":["CVE-2026-84366"],"summary":"### Problem\n\nScrapy\u2019s `S3DownloadHandler` sends signed S3 requests over plaintext HTTP by default.\n\nA normal request like `s3:\/\/bucket\/key` is converted into `http:\/\/bucket.s3.amazonaws.com\/key` unless `request.meta[\"is_secure\"]` is explicitly set. The generated request is then s","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"scrapy","publishedAt":"2026-09-02T22:50:44Z","exploitedKev":false,"fixedVersion":"2.17","vulnerableRange":"< 2.17.0"},{"id":"GHSA-7mqg-cx4g-x2rf","title":"Omnigent Guardrail policy bypass: shell-command parser fails open in policies\/builtins\/_shell.py","aliases":["CVE-2026-62676"],"summary":"**Reporter:** Aaron \/ Aeon \u2014 autonomous security agent (https:\/\/github.com\/aaronjmars\/aeon)\n**Project:** `omnigent-ai\/omnigent` v0.1.0 (Databricks) \u2014 meta-harness running Claude Code \/ Codex \/ Pi \"in check with policies and sandboxing\"\n**Component:** `omnigent\/policies\/builtins\/_","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"omnigent","publishedAt":"2026-09-02T22:40:07Z","exploitedKev":false,"fixedVersion":"0.3.0","vulnerableRange":"< 0.3.0"},{"id":"GHSA-4q39-2jhr-7qx8","title":"Plate: SSRF with response disclosure in DOCX image embedding","aliases":["CVE-2026-65842"],"summary":"## Summary\n\n`@platejs\/docx-io` can fetch remote image URLs while converting HTML to DOCX. When an application converts attacker-controlled HTML in a server-side or privileged environment, this can cause the application environment to make unintended outbound requests and include ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@platejs\/docx-io","publishedAt":"2026-09-02T22:14:54Z","exploitedKev":false,"fixedVersion":"53.3.2","vulnerableRange":"< 53.3.2"},{"id":"GHSA-7mgc-c7pq-3rr3","title":"Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge","aliases":["CVE-2026-62669"],"summary":"### Summary\nWhen 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the `login.regenerate2FASecret` task which requires only `$user->exists()`, not `$use","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-02T22:01:25Z","exploitedKev":false,"fixedVersion":"2.0.4","vulnerableRange":"< 2.0.4"},{"id":"GHSA-p8rw-8qj3-hf33","title":"Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE","aliases":["CVE-2026-62677"],"summary":"### Summary\n\nAn authenticated, non-admin user can obtain **arbitrary host-filesystem read\/write** (and host environment-secret disclosure) on an Omnigent **runner** by uploading an agent bundle whose `os_env.cwd` points outside any intended workspace (e.g. `\/` or `\/home\/<victim>`","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"omnigent","publishedAt":"2026-09-02T22:00:54Z","exploitedKev":false,"fixedVersion":"0.3.0","vulnerableRange":"< 0.3.0"},{"id":"GHSA-jrrm-9hc7-2v3h","title":"Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE","aliases":["CVE-2026-62674"],"summary":"### Summary\n\nAn authenticated user with edit access to their own session can overwrite a shared\/template agent by uploading a full agent bundle through `PUT \/sessions\/{session_id}\/agent`.\n\nShared\/template agents are shown as not MCP-editable, but this upload path still accepts a ","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"omnigent","publishedAt":"2026-09-02T21:55:11Z","exploitedKev":false,"fixedVersion":"0.3.0","vulnerableRange":"< 0.3.0"},{"id":"GHSA-756x-9hf6-q4h4","title":"Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools","aliases":["CVE-2026-62675"],"summary":"### Summary\n\nAn authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous `callable:` paths in untrusted user-provided agent configs.\n\nWhen the tool is invoked, t","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"omnigent","publishedAt":"2026-09-02T21:54:52Z","exploitedKev":false,"fixedVersion":"0.3.0","vulnerableRange":"< 0.3.0"},{"id":"GHSA-cpjf-6666-r8fx","title":"link-preview-js DNS Rebinding SSRF Bypass \/ Incomplete Fix for CVE-2026-43897","aliases":["CVE-2026-61704"],"summary":"The existing advisory GHSA-4gp8-rjrq-ch6q \/ CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used.\n\nRoot cause:\nThe library validates one resolved IP address through resolveDNSHost, bu","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"link-preview-js","publishedAt":"2026-09-02T21:29:57Z","exploitedKev":false,"fixedVersion":"4.0.4","vulnerableRange":"<= 4.0.3"},{"id":"GHSA-5jgf-p345-68v8","title":"fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references","aliases":["CVE-2026-75931"],"summary":"### Impact\n\n`fast-uri` canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When `resolve()` resolves a scheme-relative reference (`\/\/host\/`) against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is know","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fast-uri","publishedAt":"2026-09-02T15:44:30Z","exploitedKev":false,"fixedVersion":"2.4.5","vulnerableRange":">= 2.4.2 < 2.4.5"},{"id":"GHSA-f65p-4m7j-42xc","title":"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization","aliases":["CVE-2026-75975"],"summary":"### Impact\n\n`fast-uri` does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6 address with no error reported. For example, `normalize('http:\/\/[::not-valid]\/priv","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fast-uri","publishedAt":"2026-09-02T15:43:30Z","exploitedKev":false,"fixedVersion":"2.4.5","vulnerableRange":">= 2.3.1 < 2.4.5"},{"id":"GHSA-fph4-wmhf-6fwf","title":"fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding","aliases":["CVE-2026-75899"],"summary":"### Impact\n\n`fast-uri` decodes a hostname's percent escapes twice in a single `normalize()` or `resolve()` call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination b","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fast-uri","publishedAt":"2026-09-02T15:42:39Z","exploitedKev":false,"fixedVersion":"2.4.5","vulnerableRange":">= 2.4.1 < 2.4.5"},{"id":"GHSA-jqff-g426-hqxp","title":"fast-uri vulnerable to host confusion via percent-encoded scheme normalization","aliases":["CVE-2026-76172"],"summary":"### Impact\n\n`fast-uri` decodes percent-encoded characters in the scheme component with the legacy global `unescape()` and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 sc","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fast-uri","publishedAt":"2026-09-02T15:41:53Z","exploitedKev":false,"fixedVersion":"2.4.5","vulnerableRange":">= 2.3.1 < 2.4.5"},{"id":"GHSA-p3m8-78j2-g5p3","title":"NLTK: Default ENFORCE=False Disables All pathsec Security Controls","aliases":["CVE-2026-62388"],"summary":"NLTK's pathsec.py security module defaults to ENFORCE=False (line 24), which means all 8 security validation functions only emit RuntimeWarning instead of raising exceptions when violations are detected.\n\nThe pathsec module was introduced as the fix for CVE-2024-39705 (arbitrary ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-02T15:40:33Z","exploitedKev":false,"fixedVersion":"3.10.0","vulnerableRange":"<= 3.9.4"},{"id":"GHSA-6m44-fpc8-c3rq","title":"Mistune: Denial of Service \u2014 RecursionError via Excessive Emphasis Markers in Markdown","aliases":["CVE-2026-76098"],"summary":"## Summary\nMistune v3.3.2 is vulnerable to a Denial of Service (DoS) attack via uncontrolled recursion in the HTML rendering of deeply-nested emphasis tokens. By submitting Markdown containing approximately 1,000 consecutive asterisk characters, an attacker causes the Python proc","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mistune","publishedAt":"2026-09-02T15:14:55Z","exploitedKev":false,"fixedVersion":"3.3.3","vulnerableRange":">= 3.3.0 < 3.3.3"},{"id":"GHSA-vmg4-6gfg-83qx","title":"ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS","aliases":["CVE-2026-71553"],"summary":"The vulnerability is a single-request persistent DoS by submitting e.g.\n\"PATCH \/api\/v1\/article\/<id>\" with a valid editor session and body of\n{\"toString.call\":\"x\"}, overwriting the global toString function with\nvalue x.\n\nFabian","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"apostrophe","publishedAt":"2026-09-02T15:12:41Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 4.32.0"},{"id":"GHSA-cxq5-97v7-87j8","title":"Orval: Generation-time SSRF + remote\/local file inclusion via unrestricted $ref","aliases":["CVE-2026-62680"],"summary":"### Summary\n\nOrval resolves OpenAPI `$ref`s by fetching remote `http(s)` URLs and reading local files (including\nabsolute \/ out-of-tree paths), inlining the referenced schema into the generated client. Running\n`orval` on a spec whose `$ref` points at an attacker\/internal URL or a","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"orval","publishedAt":"2026-09-02T14:54:48Z","exploitedKev":false,"fixedVersion":"8.22.0","vulnerableRange":"< 8.22.0"},{"id":"GHSA-p4cg-3328-rvfg","title":"Orval: Import-time RCE via query-parameter default -> zod module-level template literal","aliases":["CVE-2026-72716"],"summary":"### Summary\n\nOrval's zod schema generation emits the **query-parameter** `default` value as a module-level template literal\n(`export const \u2026Default = `<default>`;`) without escaping `${` or the backtick. A default of the form\n`v${<code>}w` injects a live JavaScript expression eva","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"orval","publishedAt":"2026-09-02T14:53:14Z","exploitedKev":false,"fixedVersion":"8.21.0","vulnerableRange":"< 8.21.0"},{"id":"GHSA-6mr6-jvcr-2f25","title":"Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client","aliases":["CVE-2026-71866"],"summary":"### Summary\n\norval's zod client emits each schema property name as a double-quoted key in the generated zod.object({...})\nWITHOUT escaping the double quote. A \" in a property name closes the key and lands in object-literal\ncontext, where an injected computed property key [expr] i","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"orval","publishedAt":"2026-09-02T14:52:56Z","exploitedKev":false,"fixedVersion":"8.21.0","vulnerableRange":"< 8.21.0"},{"id":"GHSA-2v6v-25fm-p4fg","title":"SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control","aliases":["CVE-2026-72920"],"summary":"### Impact\nThe filer registered the IAM gRPC service (`SeaweedIdentityAccessManagement`) with no authentication. Any client able to reach the filer gRPC port could invoke IAM RPCs \u2014 `CreateUser`, `CreateAccessKey`, `PutUserPolicy`, and related calls \u2014 to mint credentials and gran","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/seaweedfs\/seaweedfs","publishedAt":"2026-09-02T14:51:58Z","exploitedKev":false,"fixedVersion":"0.0.0-20260512171108-5e8f99f40a8a","vulnerableRange":"< 0.0.0-20260512171108-5e8f99f40a8a"},{"id":"GHSA-fj2p-qj2f-74v5","title":"Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()","aliases":["CVE-2026-64850"],"summary":"### Summary\nAn account with the `admin.pages` permission (or `api.pages.write`) can run shell\ncommands on the server. The command executes whenever anyone \u2014 including an\nunauthenticated visitor \u2014 opens the page.\n\n### Details\n`Blueprint::dynamicData()` (system\/src\/Grav\/Common\/Data","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-09-02T14:51:18Z","exploitedKev":false,"fixedVersion":"2.0.7","vulnerableRange":"< 2.0.7"},{"id":"GHSA-g2fm-8hr4-j82h","title":"EasyAdmin custom-action dispatcher bypasses access_control on other routes","aliases":["CVE-2026-81892"],"summary":"## Summary\n\nEasyAdmin serves all backend requests through a single dashboard route and, for custom actions (`Action::linkToRoute()` \/ `MenuItem::linkToRoute()`), swaps the executed controller based on the `routeName` query parameter on the `kernel.controller` event.\n\nThat swap ha","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"easycorp\/easyadmin-bundle","publishedAt":"2026-09-02T14:39:11Z","exploitedKev":false,"fixedVersion":"4.29.16","vulnerableRange":">= 4.0.0 < 4.29.16"},{"id":"GHSA-mpf4-983q-p7j4","title":" Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop","aliases":["CVE-2026-82397"],"summary":"## Summary\n\nTornado parses `application\/x-www-form-urlencoded` bodies with `urllib.parse.parse_qs` and does not pass `max_num_fields`. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, s","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"tornado","publishedAt":"2026-09-02T14:38:43Z","exploitedKev":false,"fixedVersion":"6.5.8","vulnerableRange":"<= 6.5.7"},{"id":"GHSA-gxmj-r5rf-ggwq","title":"elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)","aliases":["CVE-2026-81891"],"summary":"### Summary\n\nelFinder provides `uploadDeny` and `uploadAllow` options in its connector configuration to restrict which MIME types may be uploaded. When `uploadDeny` includes `text\/x-php`, direct upload of `.php`, `.phtml`, and `.phar` files is correctly blocked. However, the `ext","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"Studio-42\/elFinder","publishedAt":"2026-09-02T14:37:54Z","exploitedKev":false,"fixedVersion":"2.1.70","vulnerableRange":"< 2.1.70"},{"id":"GHSA-c59q-g84q-2gj5","title":"pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph","aliases":["CVE-2026-82392"],"summary":"## Summary\n\nThe virtual store linker constructs package installation directories using `path.join(modules, pkgName)` where `pkgName` is extracted from lockfile `packages` keys via `dp.parse(depPath).name` without validation. A crafted `pnpm-lock.yaml` with traversal sequences in ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"pnpm","publishedAt":"2026-09-02T14:37:13Z","exploitedKev":false,"fixedVersion":"10.34.5","vulnerableRange":"< 10.34.5"},{"id":"GHSA-vq4v-j7r6-jq4m","title":"pnpm: A tarball dependency's manifest `name` escapes node_modules \u2192 arbitrary file write\/overwrite on install","aliases":["CVE-2026-82393"],"summary":"## Summary\nWhen resolving a package, pnpm uses the resolved **manifest `name`** as a raw path segment for the isolated-linker import target. A tarball dependency whose `package.json` `name` is a scoped path traversal (`@x\/..\/..\/\u2026\/<abs path>`) is therefore extracted **outside `nod","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"pnpm","publishedAt":"2026-09-02T14:36:59Z","exploitedKev":false,"fixedVersion":"10.34.5","vulnerableRange":"< 10.34.5"},{"id":"GHSA-8mgp-746c-j5xp","title":"NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots","aliases":["CVE-2026-81726"],"summary":"### Summary\n\nSeveral model-artifact APIs still treat caller-controlled model paths as ordinary filenames even when NLTK path security is enforced. The same outside-root paths are rejected by guarded helpers, but these public read and write flows still use raw file APIs.\n\n### Deta","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-02T14:35:04Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.10.3"},{"id":"GHSA-qxc2-j82w-r537","title":"Faker: helpers.fake exploitable into arbritary code execution","aliases":["CVE-2026-73231"],"summary":"### Summary\n\n`faker.helpers.fake` can be tricked into arbritary code execution.\n\n### Details\n\nfakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first.\nThis can be addressed by recursively calling resolveProperty instead of a","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@faker-js\/faker","publishedAt":"2026-09-02T14:20:14Z","exploitedKev":false,"fixedVersion":"10.5.0","vulnerableRange":"<= 10.4.0"},{"id":"GHSA-275h-v5h9-vr82","title":"Siyuan: Authenticated path traversal in \/snippets\/ static handler (serveSnippets) leaks conf\/conf.json secrets and siyuan.db","aliases":["CVE-2026-59832"],"summary":"Reporter: Cavan Loughran, Celvex Group Inc.\n\nSummary\n-------\nThe \/snippets\/*filepath route handler serveSnippets in kernel\/server\/serve.go performs a bare filepath.Join(util.SnippetsPath, filePath) on the single-decoded c.Request.URL.Path and serves the result with c.File(), with","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-02T14:17:44Z","exploitedKev":false,"fixedVersion":"0.0.0-20260704035520-68cc0f537dfa","vulnerableRange":"< 0.0.0-20260704035520-68cc0f537dfa"},{"id":"GHSA-h89q-4j2h-7h88","title":"SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content","aliases":["CVE-2026-59834"],"summary":"## Summary\n\nSiyuan's block search endpoint concatenates attacker-controlled `paths[]` values into SQL predicates used by non-SQL search modes. Through Siyuan's publish service, an unauthenticated visitor is forwarded to the kernel with a reader-role token and can reach `POST \/api","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-09-02T14:16:08Z","exploitedKev":false,"fixedVersion":"0.0.0-20260704035518-d0f0fe146fb0","vulnerableRange":"< 0.0.0-20260704035518-d0f0fe146fb0"},{"id":"GHSA-vp52-pcj8-j9qc","title":"gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP\/2 DATA Frame Fragmentation","aliases":["CVE-2026-84304"],"summary":"### Impact\nAn unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP\/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"google.golang.org\/grpc","publishedAt":"2026-09-01T21:32:41Z","exploitedKev":false,"fixedVersion":"1.83.1","vulnerableRange":"<= 1.83.0"},{"id":"GHSA-68jx-f42c-7599","title":"TYPO3 CMS - Broken Access Control in Backend and Install Tool","aliases":["CVE-2026-19418"],"summary":"### Problem\nThe referrer enforcement introduced with [TYPO3-CORE-SA-2020-006](https:\/\/news.typo3.com\/security\/advisory\/typo3-core-sa-2020-006) ([CVE-2020-11069](https:\/\/www.cve.org\/CVERecord?id=CVE-2020-11069)) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving th","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"typo3\/cms-backend","publishedAt":"2026-09-01T21:31:42Z","exploitedKev":false,"fixedVersion":"13.4.34","vulnerableRange":">= 13.0.0 < 13.4.34"},{"id":"GHSA-52xp-w8hr-xv3c","title":"Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled","aliases":["CVE-2026-77567"],"summary":"A flaw in the challenge handling for app-based multi-factor authentication allows the second factor to be bypassed. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled.","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"filament\/filament","publishedAt":"2026-09-01T21:28:47Z","exploitedKev":false,"fixedVersion":"4.12.0","vulnerableRange":">= 4.0.0 < 4.12.0"},{"id":"GHSA-m4rf-3fr8-xwx3","title":"NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)","aliases":["CVE-2026-79675"],"summary":"## Vulnerability\n\nThe fix for CVE-2026-12841 (CWE-88, JVM argument injection) added `_validate_java_options()` to block dangerous JVM flags such as `-agentlib`, `-agentpath`, `-javaagent`, `-Xrunjdwp`, and `@argfile` references. However, the validation is only applied when settin","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-01T20:38:22Z","exploitedKev":false,"fixedVersion":"3.10.3","vulnerableRange":"<= 3.10.2"},{"id":"GHSA-8rr7-cvq3-gmfh","title":"league\/commonmark: Denial of service via distinctly-named attributes in the Attributes extension","aliases":[],"summary":"### Impact\n\n`AttributesExtension` ships with the library but must be explicitly registered on the `Environment`; it is not included in `CommonMarkConverter`, `GithubFlavoredMarkdownConverter`, or `GithubFlavoredMarkdownExtension`. **Applications that do not register `AttributesEx","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"league\/commonmark","publishedAt":"2026-09-01T20:28:40Z","exploitedKev":false,"fixedVersion":"2.10.0","vulnerableRange":">= 1.5.0 < 2.10.0"},{"id":"GHSA-6hwm-xvph-95vm","title":"NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary","aliases":["CVE-2026-78680"],"summary":"Two NLTK sites executed the Graphviz `dot` program by bare name, so process creation resolved it via the search path \u2014 and on Windows via the current working directory \u2014 rather than a validated absolute location. An attacker who can place a file named `dot` where resolution looks","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-09-01T20:27:20Z","exploitedKev":false,"fixedVersion":"3.10.3","vulnerableRange":"<= 3.10.2"},{"id":"GHSA-jjv6-8j6v-6j52","title":"league\/commonmark: Denial of service in the SmartPunct and Attributes extensions","aliases":[],"summary":"### Impact\n\nTwo first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitly registered on the `Environment`; neither is included in `CommonMarkConverter`, `GithubFlavoredMarkdownConverter`, or `GithubFlavoredMarkdownExtension`. **Appl","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"league\/commonmark","publishedAt":"2026-09-01T20:21:45Z","exploitedKev":false,"fixedVersion":"2.9.1","vulnerableRange":">= 1.5.0 < 2.9.1"},{"id":"GHSA-f8fg-pg57-v4j8","title":"league\/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed","aliases":[],"summary":"### Summary\n\nThe `AttributesExtension` documents a security guarantee:\n\n> **Note:** Attributes starting with `on` (e.g. `onclick` or `onerror`) are capable of executing\n> JavaScript code and are therefore **never allowed by default**. You must explicitly add them to\n> the `allow`","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"league\/commonmark","publishedAt":"2026-09-01T20:18:29Z","exploitedKev":false,"fixedVersion":"2.9.1","vulnerableRange":">= 2.7.0 < 2.9.1"},{"id":"GHSA-j8pm-gj4c-rq4x","title":"league\/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters","aliases":[],"summary":"### Impact\n\nAffected versions of `league\/commonmark` perform super-linear work on three independent parsing paths, all of which are reachable on a stock `new CommonMarkConverter()` with default configuration and no extensions registered. Each trigger fits on a single line of inpu","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"league\/commonmark","publishedAt":"2026-09-01T20:17:59Z","exploitedKev":false,"fixedVersion":"2.9.1","vulnerableRange":">= 0.6.0 < 2.9.1"},{"id":"GHSA-xwg4-73v4-xw9w","title":"nanoid: Integer Overflow or Wraparound","aliases":["CVE-2026-73086"],"summary":"### Summary\n\nAn integer overflow in `nanoid(size)` permanently corrupts the process-wide CSPRNG pool, causing all subsequent ID generation to return the deterministic string `\"uuuuuuuuuuuuuuuuuuuuu\"`. Any application that passes user-influenced values to the `size` parameter lose","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nanoid","publishedAt":"2026-09-01T19:23:45Z","exploitedKev":false,"fixedVersion":"3.3.12","vulnerableRange":"< 3.3.12"},{"id":"GHSA-vx52-2968-3vc6","title":"pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml","aliases":[],"summary":"## Summary\n\npnpm expands `${VAR}` environment placeholders in the `httpProxy` \/ `httpsProxy` \/ `noProxy` settings read from a project's `pnpm-workspace.yaml`. Because a project manifest is repository-controlled, a malicious repository that a victim merely clones and runs `pnpm in","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"pnpm","publishedAt":"2026-09-01T19:22:42Z","exploitedKev":false,"fixedVersion":"11.11.0","vulnerableRange":">= 11.0.0 < 11.11.0"},{"id":"GHSA-2rx9-3g3h-c2jv","title":"pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project","aliases":[],"summary":"## Summary\n\nA crafted lockfile alias could reach several install-time filesystem joins. With `--trust-lockfile` or a frozen lockfile, traversal segments could create links outside the intended project or `node_modules` boundary. This patch validates dependency names and every vir","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"pnpm","publishedAt":"2026-09-01T18:59:22Z","exploitedKev":false,"fixedVersion":"12.0.0-alpha.5","vulnerableRange":">= 12.0.0-alpha.0 < 12.0.0-alpha.5"},{"id":"GHSA-gqvg-gmmx-x4hm","title":"MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor \u2014 RCE via crafted model artifact","aliases":[],"summary":"## Summary\n\nMLflow introduced `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` as a security control to prevent unsafe `pickle.load` execution during model loading, in response to CVE-2024-37052 through CVE-2024-37060. When set to `False`, operators expect all pickle deserialization to be b","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mlflow","publishedAt":"2026-09-01T17:04:30Z","exploitedKev":false,"fixedVersion":"3.15.0","vulnerableRange":">= 2.1.0 < 3.15.0"},{"id":"GHSA-c83g-rgw3-j3cx","title":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","aliases":["CVE-2026-73089"],"summary":"## Vulnerability Details\n\n**File**: `index.js`\n**Location**: `cache` (browserslist()'s result cache, line ~402) and\n`parseCache` (parseQueries()'s AST cache)\n\n### Root Cause\n```js\nvar cache = {}\nvar parseCache = {}\n\nfunction browserslist(queries, opts) {\n  ...\n  var cacheKey = JS","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"browserslist","publishedAt":"2026-09-01T16:42:13Z","exploitedKev":false,"fixedVersion":"4.28.7","vulnerableRange":"<= 4.28.6"},{"id":"GHSA-73wf-gq98-2v4g","title":"Browserslist: Uncaught crash \/ prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","aliases":["CVE-2026-73088"],"summary":"## Vulnerability Details\n\n**File**: `node.js`\n**Function**: `normalizeStats()` (line ~214), reached from `getStat()` (called\n**unconditionally** on every `browserslist()` call) and `loadStat()`\n\n### Root Cause\n```js\nfunction normalizeStats(data, stats) {\n  if (!data) { data = {} ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"browserslist","publishedAt":"2026-09-01T16:41:54Z","exploitedKev":false,"fixedVersion":"4.28.7","vulnerableRange":"<= 4.28.6"},{"id":"GHSA-3f6p-5ww8-9rcr","title":"MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials","aliases":[],"summary":"## Summary\n\nA rogue MySQL server (or MITM) can force mysql2 to send credentials in **plaintext** by requesting an auth switch to `mysql_clear_password`. The driver complies without verifying that TLS is active.\n\n## Details\n\n`mysql_clear_password` is registered as a default standa","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"mysql2","publishedAt":"2026-09-01T16:40:34Z","exploitedKev":false,"fixedVersion":"3.22.0","vulnerableRange":"< 3.22.0"},{"id":"GHSA-x9r9-c232-4q39","title":"Hugging Face Transformers downloads custom generation code before trust consent","aliases":["CVE-2026-80047"],"summary":"A vulnerability in Hugging Face Transformers (versions 4.49.0, <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"transformers","publishedAt":"2026-09-01T15:31:13Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 4.49.0 <= 5.8.1"},{"id":"GHSA-67mx-6wf2-92xp","title":"Kirby: File upload permissions are not checked during processing of chunk data","aliases":["CVE-2026-71415"],"summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites where users of a particular role have access to the REST API (`access.panel` permission is enabled) but no permission to upload any kind of file (`files.create`, `files.replace` and `user\/users.update` permissions are all disa","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getkirby\/cms","publishedAt":"2026-08-31T22:14:05Z","exploitedKev":false,"fixedVersion":"5.5.2","vulnerableRange":">= 5.0.0 < 5.5.2"},{"id":"GHSA-9vx2-j98c-p72w","title":"Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling","aliases":["CVE-2026-75594"],"summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes (`%2f`), such as nginx, PHP's built-in server or Apache setups that have the option `AllowEncodedSlashes` enabled.\n \nIt was possible to create an","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getkirby\/cms","publishedAt":"2026-08-31T22:12:45Z","exploitedKev":false,"fixedVersion":"4.9.5","vulnerableRange":"<= 4.9.4"},{"id":"GHSA-vf76-f5cp-9846","title":"Duplicate Advisory: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-w3v8-gmh9-3wv7. This link is maintained to preserve external references.\n\n## Original Description\nNLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-31T21:31:52Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.10.2"},{"id":"GHSA-gr94-w7qr-f4j3","title":"Socket.IO: Engine.IO WebTransport SID DoS","aliases":["CVE-2026-59724"],"summary":"### Impact\n\nEngine.IO servers with **WebTransport enabled** are vulnerable to a remotely triggerable denial of service.\n\nA malicious unauthenticated client can send a crafted WebTransport upgrade request containing a specially chosen session ID, such as `__proto__`. Because the s","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"engine.io","publishedAt":"2026-08-31T21:28:12Z","exploitedKev":false,"fixedVersion":"6.6.7","vulnerableRange":">= 6.5.0 < 6.6.7"},{"id":"GHSA-8x3q-jpjh-qh5c","title":"elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback","aliases":["CVE-2026-81889"],"summary":"[poc.zip](https:\/\/github.com\/user-attachments\/files\/30352020\/poc.zip)\n## Summary\n\nelFinder 2.1.69 is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass when PHP cURL is unavailable and URL uploads use the `fsock_get_contents()` fallback.\n\nAn attacker who can sub","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"studio-42\/elfinder","publishedAt":"2026-08-31T20:28:06Z","exploitedKev":false,"fixedVersion":"2.1.70","vulnerableRange":"<= 2.1.69"},{"id":"GHSA-h3hj-cmcx-xc66","title":"Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess\/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-p6gq-j5cr-w38f. This link is maintained to preserve external references.\n\n## Original Description\nnodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to messa","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nodemailer","publishedAt":"2026-08-31T09:30:29Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 9.0.0"},{"id":"GHSA-frj6-5rhh-vwfw","title":"Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-r7g4-qg5f-qqm2. This link is maintained to preserve external references.\n\n## Original Description\nNodemailer before 8.0.8 disables TLS certificate verification in lib\/fetch\/index.js through ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nodemailer","publishedAt":"2026-08-31T09:30:29Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 8.0.7"},{"id":"GHSA-ffg3-p8fm-mjx2","title":"RestrictedPython guard hooks can be shadowed via positional-only arguments","aliases":["CVE-2026-55830"],"summary":"### Impact\n\nRestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes `_getattr_(obj, name)`, item access becomes `_getitem_(obj, key)`, writes go through `_write_`, and print goes through `_print_`. The embedding application supplies thes","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"RestrictedPython","publishedAt":"2026-08-28T22:51:35Z","exploitedKev":false,"fixedVersion":"8.3","vulnerableRange":"<= 8.2"},{"id":"GHSA-j5g3-42wp-gqm3","title":"Snipe-IT has an Improper Privilege Management issue","aliases":["CVE-2026-55843"],"summary":"## Impact\n\nThe `update()` method in `UsersController` passes the `permission` request field unconditionally to `NormalizePermissionsPayloadAction`, which returns an empty array when the field is absent. The result is passed to `PreserveUnauthorizedPrivilegedPermissionsAction`, wh","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"snipe\/snipe-it","publishedAt":"2026-08-28T22:37:24Z","exploitedKev":false,"fixedVersion":"8.6.0","vulnerableRange":"< 8.6.0"},{"id":"GHSA-334q-h5g3-fpxv","title":"free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI","aliases":["CVE-2026-55784"],"summary":"### Summary\n\nThe AUSF component of free5GC stores per-subscriber authentication state in a global `sync.Map` keyed only by SUPI. Every incoming authentication request creates a new `AusfUeContext` and stores it under that SUPI key without checking whether an authentication proced","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/free5gc\/ausf","publishedAt":"2026-08-28T22:24:11Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 1.4.4"},{"id":"GHSA-56wq-x3wv-3ff4","title":"SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read","aliases":["CVE-2026-55874"],"summary":"### Summary\nThe SeaweedFS S3 API gateway did not reject `..` path segments in the `X-Amz-Copy-Source` header used by `CopyObject` and `UploadPartCopy`. The request URL path was hardened against traversal in 4.30 (CVE-2026-54917), but the copy-source header was only checked for em","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/seaweedfs\/seaweedfs","publishedAt":"2026-08-28T22:17:33Z","exploitedKev":false,"fixedVersion":"0.0.0-20260612000715-b44cf51fe931","vulnerableRange":"< 0.0.0-20260612000715-b44cf51fe931"},{"id":"GHSA-mrpp-v6pg-p54x","title":"klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply","aliases":["CVE-2026-55764"],"summary":"## Summary\nOn the SFT add-quantity path the only supply bound is `SFTAddCirculation`, which does\n`meta.Circulation += amount` with **no overflow guard**, then checks\n`if meta.Circulation > meta.MaxSupply && meta.MaxSupply != 0`. If `amount` overflows `int64` and wraps\n**negative*","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/klever-io\/klever-go","publishedAt":"2026-08-28T22:08:56Z","exploitedKev":false,"fixedVersion":"1.7.19","vulnerableRange":"< 1.7.19"},{"id":"GHSA-x626-fcwx-f5pc","title":"Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances","aliases":["CVE-2026-55761"],"summary":"## Summary\nPortainer supports restoring an instance from a backup archive via the \/api\/restore endpoint. This endpoint is intentionally unauthenticated to allow restoring before the first admin account is created, and remains accessible for the five-minute initialization window t","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/portainer\/portainer","publishedAt":"2026-08-28T20:28:19Z","exploitedKev":false,"fixedVersion":"2.39.4","vulnerableRange":">= 2.39.0 < 2.39.4"},{"id":"GHSA-v358-wf77-39xv","title":"klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits","aliases":["CVE-2026-55763"],"summary":"## Summary\nIn `processPercentageRoyaltiesTransfer` the royalty pool is collected from the sender by `SubFromBalance` that is\nordered **after** the split loop and after `if royaltiesToPay <= 0 { return Ok }`. The split-payout guard rejects\nonly an allocation that *exceeds* the poo","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/klever-io\/klever-go","publishedAt":"2026-08-28T20:27:44Z","exploitedKev":false,"fixedVersion":"1.7.19-rc4","vulnerableRange":"<= 1.7.19-rc2"},{"id":"GHSA-hr6j-w4mw-g9mj","title":"alos-http has unauthenticated remote DoS: malformed path starting with \"?\" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server","aliases":["CVE-2026-55484"],"summary":"### Summary\nA single unauthenticated HTTP request to a path starting with `?` (e.g. `GET ? HTTP\/1.1`) crashes the entire server process.\nThe request line parser passes the path to `sanitizeRequestPath` which indexes the first byte of the path after stripping the query string. It ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/guno1928\/alos-http","publishedAt":"2026-08-28T19:19:38Z","exploitedKev":false,"fixedVersion":"0.0.0-20260617230736-314b6783e196","vulnerableRange":"< 0.0.0-20260617230736-314b6783e196"},{"id":"GHSA-9x44-4gxf-8c25","title":"Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name","aliases":["CVE-2026-55634"],"summary":"## Overview\n\nA DataObject **class-definition field name** is concatenated, without an identifier allowlist, into the PHP class source that Pimcore generates for every DataObject class (`protected $<fieldName>;`). A user holding only the ordinary `objects` (DataObjects) permission","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"pimcore\/pimcore","publishedAt":"2026-08-28T19:17:42Z","exploitedKev":false,"fixedVersion":"12.3.10","vulnerableRange":"<= 12.3.9"},{"id":"GHSA-w23p-wrp7-ch38","title":"Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)","aliases":["CVE-2026-55220"],"summary":"## Summary\n\n`Pimcore\\Model\\DataObject\\ClassDefinition\\Data\\Hotspotimage::getDataFromResource()` deserializes the `*__hotspots` object-store column through the `Pimcore\\Tool\\Serialize::unserialize()` wrapper **without a class allowlist** (the wrapper's `$allowedClasses` parameter ","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"pimcore\/pimcore","publishedAt":"2026-08-28T19:13:25Z","exploitedKev":false,"fixedVersion":"2026.1.6","vulnerableRange":">= 2026.1.0 <= 2026.1.5"},{"id":"GHSA-f97c-ph8j-8vff","title":"Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation","aliases":["CVE-2026-55212"],"summary":"### Summary\nThe Studio API class definition creation endpoint in `pimcore\/studio-backend-bundle` is guarded by the `objects` permission instead of the `classes` permission, allowing any standard editor-level user to create class definitions without admin privileges. Class definit","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"pimcore\/studio-backend-bundle","publishedAt":"2026-08-28T19:05:25Z","exploitedKev":false,"fixedVersion":"2026.1.6","vulnerableRange":"< 2025.4.6"},{"id":"GHSA-79cw-hfcc-7mw9","title":"Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes","aliases":["CVE-2026-55208"],"summary":"## Summary\n\nAn authenticated user extracts the admin password hash and any other database content through a time-based blind SQL injection in the `DateFilter` column key parameter. The `POST \/pimcore-studio\/api\/website-settings` endpoint (and 11 other listing endpoints) accepts a","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"pimcore\/studio-backend-bundle","publishedAt":"2026-08-28T19:04:54Z","exploitedKev":false,"fixedVersion":"2025.4.6","vulnerableRange":"< 2025.4.6"},{"id":"GHSA-h854-c3m3-mh5v","title":"Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass","aliases":["CVE-2026-55207"],"summary":"## Summary\n\nAn unauthenticated attacker takes over any Pimcore admin account by sending a password reset request with an attacker-controlled `resetPasswordUrl`. The server generates a real cryptographic recovery token, appends it to the attacker's URL, and emails the link to the ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"pimcore\/studio-backend-bundle","publishedAt":"2026-08-28T19:04:16Z","exploitedKev":false,"fixedVersion":"2025.4.6","vulnerableRange":"< 2025.4.6"},{"id":"GHSA-cqhc-2h57-wpxf","title":"MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`","aliases":["CVE-2026-55215"],"summary":"### Summary\nWhen SSL\/TLS is enabled but no CA \/ server certificate is provided, the\nconnector verifies the server's identity using fingerprint validation. The\ncheck is effective,  the connection is ultimately rejected when it fails, \nbut it happens *after* the authentication exch","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"mariadb","publishedAt":"2026-08-28T19:03:38Z","exploitedKev":false,"fixedVersion":"3.2.4","vulnerableRange":"< 3.2.4"},{"id":"GHSA-r82h-mqw3-fc56","title":"plone.app.event vulnerable to denial of service via iCalendar import","aliases":["CVE-2026-55247"],"summary":"### Impact\nBy abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk (SSRF), and store XSS.\n\n### Patches\nThe problem has been patched in `plone.app.event`.\n","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"plone.app.event","publishedAt":"2026-08-28T18:59:42Z","exploitedKev":false,"fixedVersion":"5.2.4","vulnerableRange":"< 5.2.4"},{"id":"GHSA-c9f5-j9c3-mhrg","title":"Incus has a project restriction bypass in instance copy across projects","aliases":["CVE-2026-55622"],"summary":"### Summary\nMissing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secr","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/lxc\/incus\/v7\/cmd\/incusd","publishedAt":"2026-08-28T18:57:27Z","exploitedKev":false,"fixedVersion":"7.2.0","vulnerableRange":"< 7.2.0"},{"id":"GHSA-64f3-v33m-w89f","title":"Incus has a project restriction bypass for custom volume copy across projects","aliases":["CVE-2026-55621"],"summary":"### Summary\n\nMissing authorization checks exist for custom volume copying where an attacker who knows the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attack","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/lxc\/incus\/v7","publishedAt":"2026-08-28T18:52:05Z","exploitedKev":false,"fixedVersion":"7.2.0","vulnerableRange":"< 7.2.0"},{"id":"GHSA-2q2q-jr9g-v9rf","title":"Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project","aliases":["CVE-2026-55228"],"summary":"### Impact\nThe API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to.\n\n### Patches\n* https:\/\/github.com\/WeblateOrg\/weblate\/pull\/19970\n\n\n### References\n\nParts of t","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Weblate","publishedAt":"2026-08-28T18:47:29Z","exploitedKev":false,"fixedVersion":"2026.7","vulnerableRange":"< 2026.7"},{"id":"GHSA-wjmf-p669-5m5p","title":"Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching","aliases":["CVE-2026-55520"],"summary":"### Problem description\n\nProtego constructs regular expressions to match URLs against `robots.txt` `Allow:` and `Disallow:` directives, see `protego._urlpattern._URLPattern._prepare_pattern_for_regex()`. Every `*` in the directive value is translated into a lazy `.*?` regex piece","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Protego","publishedAt":"2026-08-28T18:43:02Z","exploitedKev":false,"fixedVersion":"0.6.2","vulnerableRange":"<= 0.6.1"},{"id":"GHSA-x5g3-w747-2h8q","title":"plone.app.portlets vulnerable to denial of service via RSS feed portlet","aliases":["CVE-2026-55248"],"summary":"### Impact\nBy adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numb","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"plone.app.portlets","publishedAt":"2026-08-28T18:41:35Z","exploitedKev":false,"fixedVersion":"7.0.2","vulnerableRange":">= 7.0.0 <= 7.0.1"},{"id":"GHSA-86m2-fcxq-5q7c","title":"9router: Unauthenticated `\/v1` proxy access via `Host`-header spoofing \u2192 open AI relay + SSRF","aliases":["CVE-2026-55641"],"summary":"## Summary\n\n9router's request guard decides a request is \"local\" (and therefore exempt from API-key auth on the `\/v1` LLM proxy) by reading the **client-controlled `Host` header**. Because 9router binds `0.0.0.0` by default (and the CLI misleadingly prints \"localhost\"), a remote,","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"9router","publishedAt":"2026-08-28T18:33:20Z","exploitedKev":false,"fixedVersion":"0.5.2","vulnerableRange":"< 0.5.2"},{"id":"GHSA-8gmq-j984-vp4r","title":"9router: Unauthenticated LLM proxy access via \/codex rewrite authorization bypass","aliases":["CVE-2026-55638"],"summary":"## Summary\n\n9router exposes an OpenAI\/Anthropic-compatible LLM proxy. Remote access to this proxy is intended to be protected by an API-key check in the Next.js middleware.\n\nHowever, 9router also defines a rewrite that maps `\/codex\/*` to the backend LLM endpoint `\/api\/v1\/response","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"9router","publishedAt":"2026-08-28T18:32:01Z","exploitedKev":false,"fixedVersion":"0.5.2","vulnerableRange":"< 0.5.2"},{"id":"GHSA-786w-p5pm-cvgh","title":"phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For \/ Client-IP headers","aliases":["CVE-2026-55584"],"summary":"## Summary\nphpSysInfo's `PSI_ALLOWED` IP allowlist can be trivially bypassed by any unauthenticated remote attacker. The access-control check in `read_config.php` derives the client IP from the attacker-controlled `X-Forwarded-For` and `Client-IP` HTTP headers **before** falling ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"phpsysinfo\/phpsysinfo","publishedAt":"2026-08-28T18:30:55Z","exploitedKev":false,"fixedVersion":"3.4.6","vulnerableRange":"<= 3.4.5"},{"id":"GHSA-w98g-5w9p-p3rc","title":"Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4\/NAT64, and site-local in FetchAndEncodeURL","aliases":["CVE-2026-55245"],"summary":"## Summary\n\n`isPublicIP` in `core\/providers\/utils\/fetch.go` \u2014 the SSRF deny-list that gates `FetchAndEncodeURL` \u2014 does not reject several routable address ranges that map onto internal infrastructure. Carrier-Grade NAT (`100.64.0.0\/10`, RFC 6598), IPv6 6to4 (`2002::\/16`), NAT64 (","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/maximhq\/bifrost\/core","publishedAt":"2026-08-28T18:26:02Z","exploitedKev":false,"fixedVersion":"1.5.17","vulnerableRange":"< 1.5.17"},{"id":"GHSA-2gh4-jmwq-rr8w","title":"piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET \/api\/tables\/sessions\/.","aliases":["CVE-2026-55485"],"summary":"## Summary\n\n`piccolo_admin` uses a helper called `superuser_validators` to gate access to the user and session tables for non-superusers. The helper rejects `PUT`, `PATCH`, `DELETE`, and `POST`, but **does not reject `GET`**.\n\nThe `sessions` table stores live session tokens **in ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"piccolo-admin","publishedAt":"2026-08-28T18:14:13Z","exploitedKev":false,"fixedVersion":"1.14.0","vulnerableRange":"<= 1.13.0"},{"id":"GHSA-p6gw-4frg-j7jw","title":"WsgiDAV MySQL provider has a blind SQL injection","aliases":["CVE-2026-55509"],"summary":"### Summary\n\nThe sample `MySQLBrowserProvider` builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Sin","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"WsgiDAV","publishedAt":"2026-08-28T18:12:17Z","exploitedKev":false,"fixedVersion":"4.3.5","vulnerableRange":"<= 4.3.4"},{"id":"GHSA-575r-357h-fhch","title":"Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update","aliases":["CVE-2026-55516"],"summary":"### Impact\nThe API endpoint for updating asset maintenance records allows an authorized user to change the asset_id of an existing maintenance record to an asset outside their company scope.\n\nIn a Full Multiple Company Support \/ multi-company deployment, this allows a user from C","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"snipe\/snipe-it","publishedAt":"2026-08-28T18:06:05Z","exploitedKev":false,"fixedVersion":"8.6.2","vulnerableRange":"<= 8.6.1"},{"id":"GHSA-c6f4-wj38-m3g3","title":"Snipe-IT vulnerable to directory traversal in displaySig","aliases":["CVE-2026-55474"],"summary":"### Impact\nThe `displaySig` action in `ActionlogController` serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to travers","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"snipe\/snipe-it","publishedAt":"2026-08-28T18:01:32Z","exploitedKev":false,"fixedVersion":"8.5.0","vulnerableRange":"< 8.5.0"},{"id":"GHSA-vgx7-c78r-69w9","title":"Snipe-IT has an authorization bypass on bulk editing users","aliases":["CVE-2026-55460"],"summary":"### Impact\nAn authenticated non-admin user with `users.view` and `users.edit`, but without `users.delete`, can directly POST to `\/users\/bulksave` and soft-delete another non-admin user. The UI and confirmation route require `users.delete`, but the destructive sink only authorizes","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"snipe\/snipe-it","publishedAt":"2026-08-28T17:48:36Z","exploitedKev":false,"fixedVersion":"8.6.2","vulnerableRange":"<= 8.6.1"},{"id":"GHSA-x8mj-6p3q-g5pp","title":"free5GC NRF nnrf-nfm lacks NF Profile input validation \u2014 enables NF Registration Poisoning with arbitrary service endpoints","aliases":["CVE-2026-55068"],"summary":"### Summary\n\nfree5GC NRF (Docker image free5gc-fuzz:latest) accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constra","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/free5gc\/free5gc","publishedAt":"2026-08-28T16:58:13Z","exploitedKev":false,"fixedVersion":"4.2.2","vulnerableRange":"< 4.2.2"},{"id":"GHSA-5pg6-m483-7vrg","title":"Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id","aliases":["CVE-2026-55066"],"summary":"## Summary\n\nThe kanban endpoint `POST \/api\/v1\/projects\/{project}\/views\/{view}\/buckets\/{bucket}\/tasks`\nmoves a task into a bucket. The task is identified by `task_id` in the **request\nbody**. The endpoint's authorization check (`TaskBucket.CanUpdate`) only verifies\nthat the caller","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-08-28T16:52:16Z","exploitedKev":false,"fixedVersion":"2.4.0","vulnerableRange":"<= 2.3.0"},{"id":"GHSA-gg93-x632-9ccv","title":"Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key","aliases":["CVE-2026-55065"],"summary":"### Summary\n\nA user with only a single self-owned project can permanently destroy the Kanban bucket assignments (`task_buckets`) and task ordering (`task_positions`) of **any other project view in the entire instance**. The `ProjectView.Delete` model method runs three SQL stateme","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-08-28T16:50:34Z","exploitedKev":false,"fixedVersion":"2.4.0","vulnerableRange":">= 0.24.6 < 2.4.0"},{"id":"GHSA-gpwf-4h98-v82q","title":"datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS","aliases":["CVE-2026-54788"],"summary":"### Impact\nDatadog tracing libraries that implement W3C Trace Context (`tracecontext`) propagation parse the incoming `tracestate` header without enforcing a size cap on the Datadog vendor entry (`dd=...`). The `dd=` value contains semicolon-separated `key:value` pairs, and the p","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"datadog-opentelemetry","publishedAt":"2026-08-28T16:35:03Z","exploitedKev":false,"fixedVersion":"0.3.3","vulnerableRange":">= 0.1.0 < 0.3.3"},{"id":"GHSA-cgc5-v3f2-8m2v","title":"Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)","aliases":["CVE-2026-54755"],"summary":"## Summary\n\nThe per-entry percentages of a KDA asset's **split royalties** are validated by summing\nthem into a **`uint32`** accumulator and checking the *sum* against `HundredPercent (10000)`,\nwith **no upper bound on each individual entry**. Two split entries whose percentages ","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/klever-io\/klever-go","publishedAt":"2026-08-28T16:25:48Z","exploitedKev":false,"fixedVersion":"1.7.19","vulnerableRange":"< 1.7.19"},{"id":"GHSA-p7gw-2pcp-5pf8","title":"Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)","aliases":["CVE-2026-54754"],"summary":"## Summary\n\nWhen a marketplace order is settled (`MarketBuy` \/ `BuyItNow`, and auction `Claim`), the buyer's\npayment is split three ways \u2014 **referral**, **royalties**, and the **seller (market-order owner)\nremainder**:\n\n```\nmarketOwnerAmount = CurrentBid \u2212 referralAmount \u2212 royalt","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/klever-io\/klever-go","publishedAt":"2026-08-28T16:22:15Z","exploitedKev":false,"fixedVersion":"1.7.19","vulnerableRange":"< 1.7.19"},{"id":"GHSA-jw39-3688-r4rx","title":"Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data","aliases":["CVE-2026-54757"],"summary":"### Impact\n\nA Server-Side Template Injection (SSTI) vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: **untrusted data is re-parsed as Jinja2 template source code without sandboxing**. This advisory tracks the root cause ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"compliance-trestle","publishedAt":"2026-08-28T16:15:38Z","exploitedKev":false,"fixedVersion":"3.12.4","vulnerableRange":"<= 3.12.3"},{"id":"GHSA-fmgp-q6jx-gg3x","title":"KubeVela Terraform remote loader DoS via unbounded file read","aliases":["CVE-2026-55108"],"summary":"### Summary\n\nKubeVela's Terraform remote configuration loader can be abused to make `vela-core` read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service.\n\nThe issue is reachable when a user with permission to create or update ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/oam-dev\/kubevela","publishedAt":"2026-08-28T16:13:19Z","exploitedKev":false,"fixedVersion":"1.9.14","vulnerableRange":"< 1.9.14"},{"id":"GHSA-x7rj-f32v-7jjg","title":"Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS","aliases":["CVE-2026-57584"],"summary":"## Summary\n\nEvery Phalcon MVC application built with a default router (`new Phalcon\\Mvc\\Router()` or `new Phalcon\\Mvc\\Router(true)`, which is the normal case) registers a built-in route whose compiled PCRE pattern is `#^\/([\\w0-9\\_\\-]+)\/([\\w0-9\\.\\_]+)(\/.*)*$#u`. The trailing `(\/.*","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"phalcon\/cphalcon","publishedAt":"2026-08-28T16:06:31Z","exploitedKev":false,"fixedVersion":"5.15.0","vulnerableRange":"<= 5.14.2"},{"id":"GHSA-8jqh-95g6-7jpj","title":"Phalcon: Non-constant-time HMAC verification in `Encryption\\Crypt::decrypt` (timing side-channel)","aliases":["CVE-2026-54736"],"summary":"## Summary\n\n`Phalcon\\Encryption\\Crypt` provides authenticated encryption: when `useSigning` is enabled (the default), `encrypt()` appends an HMAC tag and `decrypt()` verifies it before returning the plaintext. The verification compares the attacker-supplied tag against the freshl","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"phalcon\/cphalcon","publishedAt":"2026-08-28T16:01:05Z","exploitedKev":false,"fixedVersion":"5.14.1","vulnerableRange":"<= 5.14.0"},{"id":"GHSA-6wvf-77m9-58rm","title":"LiteLLM vulnerable to server-side template injection in the \/prompts\/test endpoint","aliases":["CVE-2026-37004"],"summary":"BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the \/prompts\/test endpoint due to use of an unsandboxed jinja2.Environment.","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"litellm","publishedAt":"2026-08-27T21:31:31Z","exploitedKev":false,"fixedVersion":"1.83.7","vulnerableRange":"< 1.83.7"},{"id":"GHSA-hqj7-phwp-c3fp","title":"Duplicate Advisory: Model-artifact APIs bypass pathsec and touch files outside allowed roots","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-8mgp-746c-j5xp. This link is maintained to preserve external references.\n\n## Original Description\nNLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypa","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-27T18:32:30Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.10.3"},{"id":"GHSA-8x48-8g7j-rqxp","title":"Duplicate Advisory: Quadratic-time DoS in PorterStemmer via long runs of 'y'","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-ww6m-cw3f-q94g. This link is maintained to preserve external references.\n\n## Original Description\nnltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithm","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-27T18:32:29Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.10.2"},{"id":"GHSA-mf7q-r4rv-jv94","title":"Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check","aliases":[],"summary":"## Summary\n\nCrossplane allows package signature verification to be configured via the `ImageConfig` mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them.\n\nWhen a package is installed using a tag r","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/crossplane\/crossplane-runtime\/v2","publishedAt":"2026-08-27T17:25:25Z","exploitedKev":false,"fixedVersion":"2.4.0-rc.1","vulnerableRange":"= 2.4.0-rc.0"},{"id":"GHSA-39mm-rwm3-29jp","title":"silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template","aliases":["CVE-2026-54718"],"summary":"### Impact\nThe advanced workflow email template field is vulnerable to a specially crafted payload that can be used to run arbitrary code on the server.\n\n### Reported by\nSteve Boyd\nSilverstripe Ltd.","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"symbiote\/silverstripe-advancedworkflow","publishedAt":"2026-08-27T17:20:40Z","exploitedKev":false,"fixedVersion":"6.4.5","vulnerableRange":"< 6.4.5"},{"id":"GHSA-g8wr-r2v2-vqc6","title":"silverstripe\/userforms vulnerable to remote code execution via userforms email subject","aliases":["CVE-2026-54721"],"summary":"### Impact\nThe userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server.\n\n### Reported by\nJack Wallace from Bastion Security","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"silverstripe\/userforms","publishedAt":"2026-08-27T16:53:17Z","exploitedKev":false,"fixedVersion":"6.4.9","vulnerableRange":"< 6.4.9"},{"id":"GHSA-2rrw-hpqm-36pv","title":"Duplicate Advisory:  ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-rrv8-h7p8-rx55. This link is maintained to preserve external references.\n\n## Original Description\nNLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-26T18:31:54Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.9.4"},{"id":"GHSA-7w8c-qgxg-m7jx","title":"LibreNMS \u2014 Stored XSS via SNMP\/Syslog Data in Legacy Templates","aliases":[],"summary":"## Summary\n\nMultiple legacy PHP template files in LibreNMS directly output SNMP-sourced and syslog-sourced data into HTML without escaping. An attacker who controls a monitored network device (via compromised SNMP agent or syslog sender) can inject arbitrary JavaScript that execu","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"librenms\/librenms","publishedAt":"2026-08-26T18:05:46Z","exploitedKev":false,"fixedVersion":"26.5.0","vulnerableRange":"< 26.5.0"},{"id":"GHSA-2wxc-x7rj-hg8f","title":"asyncssh has SCP Path Traversal to Arbitrary File Write","aliases":["CVE-2026-54591"],"summary":"| | |\n|---|---|\n| Product | asyncssh (all versions through 2.23.0) |\n| Related | CVE-2019-6111 (same class in OpenSSH) |\n| Fix | AsyncSSH 2.23.1 |\n\nA malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing `..\/` trave","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"asyncssh","publishedAt":"2026-08-26T15:34:22Z","exploitedKev":false,"fixedVersion":"2.23.1","vulnerableRange":"<= 2.23.0"},{"id":"GHSA-jrw6-7x4q-w25j","title":"senaite.core Vulnerable to Eval Injection and Missing Authorization","aliases":["CVE-2026-54569"],"summary":"### Summary\n\nAn unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The `\/@@API\/update` route is reachable to anonymous callers ","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"senaite.core","publishedAt":"2026-08-26T15:28:47Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 2.0.0 <= 2.6.0"},{"id":"GHSA-w93q-cq9w-58p7","title":"SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed","aliases":["CVE-2026-54606"],"summary":"Summary\n\nA DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external <script src=...> element bypasses the plugin\u2019s sanitization logic. The plugin recreates and appends the attacker-controlled script","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"suneditor","publishedAt":"2026-08-26T15:26:24Z","exploitedKev":false,"fixedVersion":"3.1.4","vulnerableRange":"<= 3.1.3"},{"id":"GHSA-w5fv-7x5q-g8qp","title":"Cloudreve WebDAV (`\/dav`) has Path Traversal \/ Broken Access Control \u2014 scoped DAV credential escapes its configured account root","aliases":["CVE-2026-54563"],"summary":"## Summary\n\nA Cloudreve WebDAV account stores a `uri` that defines the account's root folder. The WebDAV request handler (`stripPrefix` in `pkg\/webdav\/webdav.go`) trims the `\/dav` prefix from the request path and joins the remainder to that root with `fs.URI.JoinRaw`, but never c","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/cloudreve\/Cloudreve\/v4","publishedAt":"2026-08-26T15:22:12Z","exploitedKev":false,"fixedVersion":"4.0.0-20260606032813-26b6b1044b02","vulnerableRange":"< 4.0.0-20260606032813-26b6b1044b02"},{"id":"GHSA-93qj-5q5v-3c2h","title":"Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)","aliases":[],"summary":"## Summary\nThe PyPI account that publishes `pantheon-agents` was compromised in the June 2026 \"Hades\" PyPI supply-chain attack (Mini Shai-Hulud \/ Miasma lineage). The attacker used a stolen, long-lived PyPI API token to upload **trojanized releases `pantheon-agents` 0.6.1 and 0.6","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pantheon-agents","publishedAt":"2026-08-26T14:36:45Z","exploitedKev":false,"fixedVersion":"0.6.4","vulnerableRange":">= 0.6.1 <= 0.6.2"},{"id":"GHSA-8h6h-x5pq-56fq","title":"@logtape\/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys","aliases":["CVE-2026-54511"],"summary":"`@logtape\/syslog` contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with `includeStructuredData: true`, which is non-default.\n\n## 1. Unescaped C0 control characters in structured data values\n\n`escapeStructuredDataValue(","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@logtape\/syslog","publishedAt":"2026-08-26T14:28:04Z","exploitedKev":false,"fixedVersion":"2.1.5","vulnerableRange":">= 2.1.0 <= 2.1.4"},{"id":"GHSA-79gf-7frw-68m9","title":"Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system","aliases":["CVE-2026-54523"],"summary":"## Summary\n\nIn Kyverno v1.18.1, a tenant who can create a `NamespacedMutatingPolicy` in their own namespace can instruct the admission controller to generate resources in any namespace by passing an arbitrary namespace string to the CEL `generator.apply(namespace, resources)` fun","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/kyverno\/kyverno","publishedAt":"2026-08-26T14:21:54Z","exploitedKev":false,"fixedVersion":"1.18.2","vulnerableRange":">= 1.18.0 <= 1.18.1"},{"id":"GHSA-6x9p-4r67-5gjx","title":"Budibase authenticated arbitrary S3 signed upload URL issuance via `\/api\/attachments\/:datasourceId\/url`","aliases":["CVE-2026-54356"],"summary":"### Summary\nBudibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials.\n\nThe affected endpoint is:\n\n`POST \/api\/attachments\/:da","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@budibase\/server","publishedAt":"2026-08-26T14:07:26Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.38.1"},{"id":"GHSA-cv84-9p8j-fj68","title":"icalendar has Algorithmic Complexity in Equality","aliases":["CVE-2026-55099"],"summary":"### Summary\n\n`Component.__eq__` compares subcomponents in `O(2^n)` time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte `.ics` file is enough to make a single equality check run for minutes or hang indefinitely. Any application ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"icalendar","publishedAt":"2026-08-25T19:27:31Z","exploitedKev":false,"fixedVersion":"7.1.3","vulnerableRange":">= 7.1.0 < 7.1.3"},{"id":"GHSA-hvfh-5mj3-5f3j","title":"Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access","aliases":["CVE-2026-45019"],"summary":"### Am I affected?\n\nOnly if your deployment sets `features.mcp.enabled = true` in `.chainlit\/config.toml`. **MCP has been disabled by default since v2.7.0**, so most Chainlit deployments are not affected. No authentication is required: `\/mcp` is reachable by any client that can o","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"chainlit","publishedAt":"2026-08-25T19:21:40Z","exploitedKev":false,"fixedVersion":"2.12.0","vulnerableRange":">= 2.4.0rc0 <= 2.11.1"},{"id":"GHSA-w3fx-mc44-mf6j","title":"Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution","aliases":["CVE-2026-45018"],"summary":"### Am I affected?\n\nOnly if your deployment sets `features.mcp.enabled = true` in `.chainlit\/config.toml`. **MCP has been disabled by default since v2.7.0**, so most Chainlit deployments are not affected. No authentication is required: `\/mcp` is reachable by any client that can o","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"chainlit","publishedAt":"2026-08-25T19:19:28Z","exploitedKev":false,"fixedVersion":"2.12.0","vulnerableRange":">= 2.4.0rc0 <= 2.11.1"},{"id":"GHSA-fh3r-g96v-f578","title":"@arikusi\/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key","aliases":["CVE-2026-55604"],"summary":"# Cross-Session Data Exposure via Caller-Controlled `session_id`\n\nProject \/ Repository: `arikusi\/deepseek-mcp-server`  \nAffected version \/ commit tested: `1.6.0` \/ `04f28be2c6e99d3d4e443a6ae37cc35f0a71554a`  \nVulnerability type: Authorization bypass \/ cross-session data exposure ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@arikusi\/deepseek-mcp-server","publishedAt":"2026-08-25T18:37:27Z","exploitedKev":false,"fixedVersion":"1.7.0","vulnerableRange":">= 1.4.2 < 1.7.0"},{"id":"GHSA-xc9g-j69q-37xw","title":"consciousness-explorer \/ sublinear-time-solver MCP export_state has an arbitrary file write","aliases":["CVE-2026-55609"],"summary":"### Impact\nAn arbitrary file write vulnerability (CWE-73, External Control of File Name or Path) exists in the `consciousness-explorer` component of `sublinear-time-solver`. The MCP `export_state` (and `import_state`) tool accepted a user-supplied `filepath` argument and passed i","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"consciousness-explorer","publishedAt":"2026-08-25T18:35:32Z","exploitedKev":false,"fixedVersion":"1.1.2","vulnerableRange":"< 1.1.2"},{"id":"GHSA-3vfr-4gwf-qxfp","title":"Whistle vulnerable to path traversal","aliases":["CVE-2026-55629"],"summary":"This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University.\n\n**Vulnerability detail**:\n\nIn service.js, inside \n`app.get('\/cgi-bin\/temp\/get', ...):\nvar filename = req.q","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"whistle","publishedAt":"2026-08-25T18:32:06Z","exploitedKev":false,"fixedVersion":"2.10.3","vulnerableRange":"< 2.10.3"},{"id":"GHSA-3h2g-j4wp-7qqq","title":"Duplicate Advisory: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-m4rf-3fr8-xwx3. This link is maintained to preserve external references.\n\n## Original Description\n\nNLTK before 3.10.3 fails to validate JVM options passed through the per-call options parame","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-25T18:31:52Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.10.2"},{"id":"GHSA-w5q8-6jpp-4246","title":"Duplicate Advisory: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-p4rw-rvv2-7xwr. This link is maintained to preserve external references.\n\n## Original Description\nNLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that re","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-25T18:31:52Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.10.2"},{"id":"GHSA-rcw8-9qrw-27m2","title":"Duplicate Advisory: NLTK: Corpus Reader Sandbox Bypass","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-3gq4-3j92-5w49. This link is maintained to preserve external references.\n\n## Original Description\nNLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader con","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-25T18:31:52Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.10.2"},{"id":"GHSA-g7gc-gmgp-wgqg","title":"eml_parser vulnerable to DoS via deeply nested parens in Received headers","aliases":["CVE-2026-55620"],"summary":"### Summary\n\n`eml_parser` strips parenthesised CFWS comments from `Received:` headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single `Received:` header containing 5,000 nested parens causes ~1.3 seconds of CPU s","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"eml_parser","publishedAt":"2026-08-25T18:27:18Z","exploitedKev":false,"fixedVersion":"3.0.2","vulnerableRange":"< 3.0.2"},{"id":"GHSA-cmwv-wf9p-p8wx","title":"genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport","aliases":["CVE-2026-55637"],"summary":"`genieacs-mcp` exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled `Host` and `Origin` headers. A malicious web page can use DNS rebinding to route browser requests to a victim's loopback MCP listener while preserving the attacker origin. The server acce","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/geiserx\/genieacs-mcp","publishedAt":"2026-08-25T18:05:28Z","exploitedKev":false,"fixedVersion":"0.3.2","vulnerableRange":"<= 0.3.1"},{"id":"GHSA-vwf3-4xxj-qg6h","title":"mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment","aliases":[],"summary":"### Summary\n\n`mcpgateway.services.prompt_service.PromptService` renders user-supplied prompt templates using Jinja2's plain `Environment()` rather than `SandboxedEnvironment`. An authenticated user with permission to register or update prompt templates can store a malicious templ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-contextforge-gateway","publishedAt":"2026-08-25T17:42:11Z","exploitedKev":false,"fixedVersion":"1.0.0","vulnerableRange":"< 1.0.0"},{"id":"GHSA-mcj4-mphf-j9ff","title":"Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts","aliases":["CVE-2026-55092"],"summary":"## Summary\n\nWhen Trivy downloads an OCI artifact, it uses the `org.opencontainers.image.title` annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotatio","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/aquasecurity\/trivy","publishedAt":"2026-08-25T17:33:02Z","exploitedKev":false,"fixedVersion":"0.71.1","vulnerableRange":"< 0.71.1"},{"id":"GHSA-pg62-f8g4-4wqh","title":"phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold","aliases":[],"summary":"## Overview\n\nWhen phpMyFAQ hardened its admin permission-assignment endpoints against privilege escalation, it added a \"a non-SuperAdmin may only assign rights they themselves hold\" constraint to the user-rights endpoint (`UserController::updateUserRights`). **The equivalent grou","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"phpmyfaq\/phpmyfaq","publishedAt":"2026-08-25T17:32:07Z","exploitedKev":false,"fixedVersion":"4.1.5","vulnerableRange":"<= 4.1.4"},{"id":"GHSA-qj6x-xx2h-8hvv","title":"Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript","aliases":["CVE-2026-55596"],"summary":"## Summary\n\nThe media embed renderer trusts serialized `provider` or `sourceUrl` metadata and skips the URL protocol validation that normally blocks unsafe media embed URLs. A crafted Plate document can set a known video provider while keeping `url` as a `javascript:` iframe sour","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@platejs\/media","publishedAt":"2026-08-25T16:29:25Z","exploitedKev":false,"fixedVersion":"53.1.4","vulnerableRange":">= 53.0.0 < 53.1.4"},{"id":"GHSA-m9mq-7m7q-xc6p","title":"browse-mcp has an arbitrary file write via unconfined download and state paths","aliases":["CVE-2026-55557"],"summary":"### Impact\n`browser_download` wrote a fetched file to `join(save_dir, filename)` with no validation of `save_dir`, and `browser_save_state` \/ `browser_load_state` honored an explicit `path` unchanged. The MCP caller controls these arguments (a malicious MCP client, or an autonomo","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"browse-mcp","publishedAt":"2026-08-25T16:28:32Z","exploitedKev":false,"fixedVersion":"0.8.2","vulnerableRange":"<= 0.8.1"},{"id":"GHSA-q27q-98j4-9pfv","title":"qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`","aliases":["CVE-2026-55585"],"summary":"### Summary\n\nThe `qwed` package (version 5.1.1) passes attacker-controlled input directly to SymPy's `parse_expr()` function without a restricted namespace. Because `parse_expr()` internally calls Python's `eval()`, any authenticated tenant can execute arbitrary Python code insid","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"qwed","publishedAt":"2026-08-25T16:25:19Z","exploitedKev":false,"fixedVersion":"5.1.2","vulnerableRange":"< 5.1.2"},{"id":"GHSA-hq3h-g68c-hp78","title":"urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage","aliases":["CVE-2026-55553"],"summary":"## Summary\n\nurllib supports redirect-following through `followRedirect`, which is expected behavior for an HTTP client. The issue is that, when following a redirect to a **different origin**, urllib preserves the caller-supplied request headers verbatim, including credential-bear","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"urllib","publishedAt":"2026-08-25T16:19:32Z","exploitedKev":false,"fixedVersion":"4.9.1","vulnerableRange":">= 3.0.0 <= 4.9.0"},{"id":"GHSA-vfp3-v2gw-7wfq","title":"Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files","aliases":["CVE-2026-55677"],"summary":"### Summary\n\nEcho's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving `%2F` as-is), while `StaticDirectoryHandler` unescapes `%2F` to `\/` before resolving filesystem paths. This allows an attacker to byp","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/labstack\/echo\/v5","publishedAt":"2026-08-25T16:13:29Z","exploitedKev":false,"fixedVersion":"5.2.0","vulnerableRange":"< 5.2.0"},{"id":"GHSA-xx4j-w367-7247","title":"djust authentication bypass: a login_required \/ on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls","aliases":["CVE-2026-55571"],"summary":"### Impact\n\ndjust's `LiveViewConsumer` mounts a `LiveView` over a WebSocket. When a view is gated (`login_required` \/ `permission_required`, or an `on_mount` hook that returns a redirect) and the connecting user is not authorized, the consumer sent the client a `{\"type\":\"navigate","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"djust","publishedAt":"2026-08-25T16:06:31Z","exploitedKev":false,"fixedVersion":"1.0.4","vulnerableRange":"< 1.0.4"},{"id":"GHSA-8vh3-g2qg-2h2c","title":"nextcloud-mcp-server: Unauthenticated `POST \/webhooks\/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )","aliases":["CVE-2026-55640"],"summary":"## Summary\nThe `POST \/webhooks\/nextcloud` endpoint has no authentication by default: `WEBHOOK_SECRET` defaults to `None` and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The `user_id` is taken directly from the attacker-suppl","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nextcloud-mcp-server","publishedAt":"2026-08-25T16:04:15Z","exploitedKev":false,"fixedVersion":"0.117.2","vulnerableRange":"<= 0.117.1"},{"id":"GHSA-8qx3-8gm5-9cj2","title":"pickem vulnerable to terminal escape-sequence injection via unsanitized item text","aliases":[],"summary":"### Impact\npickem rendered item text (label, description, group, meta, name) to the terminal with no control-character sanitization. `chrome.row` only stripped ANSI from the **active** row; inactive rows, the public `createFormatter`, and selection-summary lines printed labels **","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"pickem","publishedAt":"2026-08-25T15:59:11Z","exploitedKev":false,"fixedVersion":"1.0.7","vulnerableRange":"< 1.0.7"},{"id":"GHSA-8cp3-qxj6-px34","title":"utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion","aliases":[],"summary":"### Summary\n\nThe `utcp-http` library (<= 1.1.3) unconditionally trusts the `tokenUrl` field embedded in remote OpenAPI security schemes. When a victim registers an attacker-controlled OpenAPI spec and invokes any generated OAuth2-protected tool, the library POSTs the victim's `cl","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"utcp-http","publishedAt":"2026-08-25T15:57:03Z","exploitedKev":false,"fixedVersion":"1.1.4","vulnerableRange":"<= 1.1.3"},{"id":"GHSA-9qhg-99ww-9mqc","title":"utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target","aliases":[],"summary":"## Summary\n\n`HttpCommunicationProtocol.call_tool` validates only the pre-redirect tool URL, then issues the request with redirects enabled and never re-checks where it lands. A tool whose endpoint is an attacker-controlled public URL can therefore `302`-redirect the UTCP client i","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"utcp-http","publishedAt":"2026-08-25T15:48:51Z","exploitedKev":false,"fixedVersion":"1.1.4","vulnerableRange":"<= 1.1.3"},{"id":"GHSA-f5pj-2738-996m","title":"mcp-shell \u2014 Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist","aliases":["CVE-2026-55580"],"summary":"mcp-shell` at commit `17ac0eef5c9a5a42b8fb132d3d034973d55a5433` has two issues that together mean neither the default deploy path nor the recommended \"secure mode\" delivers the restriction they're marketed as providing. Filing these together because the two failure modes bracket ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/sonirico\/mcp-shell","publishedAt":"2026-08-25T15:46:50Z","exploitedKev":false,"fixedVersion":"0.6.0","vulnerableRange":"< 0.6.0"},{"id":"GHSA-3x77-wg38-92r3","title":"mcp-shell has a Secure Mode Allowlist Bypass via Default `\/bin\/bash` Executable","aliases":["CVE-2026-55581"],"summary":"### Summary\n\n`mcp-shell` ships a default Docker configuration (`security.yaml`) that includes `\/bin\/bash` in the `allowed_executables` allowlist. The command validator (`security.go`) only checks whether the first token of the supplied command matches an allowed executable; it do","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/sonirico\/mcp-shell","publishedAt":"2026-08-25T15:41:30Z","exploitedKev":false,"fixedVersion":"0.6.0","vulnerableRange":"< 0.6.0"},{"id":"GHSA-74hp-mggr-hv58","title":"mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias","aliases":["CVE-2026-55582"],"summary":"### Summary\n\n`mcp-shell`'s \"secure mode\" is designed to restrict command execution to an allowlist of executables defined in `security.yaml`. The default configuration includes `\/usr\/bin\/git`. The security validator in `security.go` blocks common shell metacharacters (`|&;<>(){}[","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/sonirico\/mcp-shell","publishedAt":"2026-08-25T15:39:05Z","exploitedKev":false,"fixedVersion":"0.6.0","vulnerableRange":"< 0.6.0"},{"id":"GHSA-mw6r-2hvm-4rp2","title":"qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input","aliases":["CVE-2026-55546"],"summary":"### Summary\n\n`verify_math_expression()` in `qwed-mcp` v0.2.0 passes attacker-controlled strings directly to SymPy's `parse_expr()` without restricting `global_dict` or validating the expression's AST. Because `parse_expr()` internally calls `eval()` and Python automatically injec","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"qwed-mcp","publishedAt":"2026-08-25T15:26:43Z","exploitedKev":false,"fixedVersion":"0.2.1","vulnerableRange":"< 0.2.1"},{"id":"GHSA-6g6r-q6gw-w8fg","title":"PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 \/ GHSA-8x8f-54wf-vv92)","aliases":["CVE-2026-55536"],"summary":"### Summary\n\n`praisonai\/browser\/server.py` validates incoming WebSocket connections using a Chrome\nextension Origin check. The regex `chrome-extension:\/\/[a-z0-9]{32}` is applied with\n`re.match()`, which **only anchors at the start of the string, not the end**. Any Origin\nheader w","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PraisonAI","publishedAt":"2026-08-25T15:22:16Z","exploitedKev":false,"fixedVersion":"4.6.58","vulnerableRange":"< 4.6.58"},{"id":"GHSA-pvph-5j39-v8qc","title":"PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server","aliases":["CVE-2026-55532"],"summary":"### Summary\n\nThe PraisonAI MCP server exposes an HTTP-stream transport (praisonai mcp serve --transport http-stream) that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PraisonAI","publishedAt":"2026-08-25T15:18:20Z","exploitedKev":false,"fixedVersion":"4.6.58","vulnerableRange":"< 4.6.58"},{"id":"GHSA-gfq8-hmph-9gjv","title":"PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret","aliases":["CVE-2026-55533"],"summary":"### Summary\n\nThe PraisonAI Recipe HTTP server silently allows unauthenticated requests when `auth` is configured as `api-key` or `jwt` but the corresponding secret is missing.\n\nThis creates an authentication fail-open condition. An operator can start the Recipe server with authen","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PraisonAI","publishedAt":"2026-08-25T15:15:54Z","exploitedKev":false,"fixedVersion":"4.6.58","vulnerableRange":"< 4.6.58"},{"id":"GHSA-2jgc-f764-c5r2","title":"PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`\/api\/v1\/runs`) has no authentication \u2014 unauthenticated job execution, result theft, cancel and delete","aliases":["CVE-2026-55539"],"summary":"### Summary\nPraisonAI's async **Jobs API** (the FastAPI service in `praisonai\/jobs\/`) installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs (executed against t","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PraisonAI","publishedAt":"2026-08-25T15:14:27Z","exploitedKev":false,"fixedVersion":"4.6.58","vulnerableRange":"< 4.6.58"},{"id":"GHSA-gxmw-5f7x-6g22","title":"praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` \u2014 path traversal to any writable location","aliases":["CVE-2026-55527"],"summary":"### Summary\n\n`praisonaiagents\/memory\/file_memory.py::FileMemory.__init__()` constructs all\nmemory file paths by directly joining the `user_id` parameter to a base path:\n\n```python\nself.user_path = self.base_path \/ user_id      # LINE 145 \u2014 no sanitization\n```\n\nNo validation or no","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-08-25T15:09:54Z","exploitedKev":false,"fixedVersion":"1.6.58","vulnerableRange":"< 1.6.58"},{"id":"GHSA-pvxx-r596-f5qj","title":"PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced","aliases":["CVE-2026-55541"],"summary":"## Summary\n\n`praisonai serve agents` and `praisonai serve unified` both accept `--api-key` for authentication. The flag is parsed but never wired into the FastAPI app \u2014 no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PraisonAI","publishedAt":"2026-08-25T15:06:09Z","exploitedKev":false,"fixedVersion":"4.6.58","vulnerableRange":"< 4.6.58"},{"id":"GHSA-rg5q-pp8p-f7jm","title":"PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` \u2014 bypass of CVE-2026-40114","aliases":["CVE-2026-55537"],"summary":"### Summary\n\n`praisonai\/jobs\/models.py::JobSubmitRequest.validate_webhook_url()` validates webhook\nURLs by resolving the hostname and checking whether the IP is private. When DNS\nresolution fails (`socket.gaierror`), the validator **silently passes** the URL via\n`except socket.ga","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PraisonAI","publishedAt":"2026-08-25T14:59:44Z","exploitedKev":false,"fixedVersion":"4.6.58","vulnerableRange":"< 4.6.58"},{"id":"GHSA-r7v3-x45f-g7hp","title":"PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored \u2014 agent-invocation routes (`POST \/agents`, `POST \/agents\/{agent_name}`) run unauthenticated","aliases":["CVE-2026-55538"],"summary":"### Summary\n`praisonai serve agents` exposes HTTP routes that invoke registered agents. The CLI advertises `--api-key` with help text \"API key for authentication\", parses it, and forwards it into `ServeHandler`. But `_create_agents_app()` **never reads `config[\"api_key\"]` again**","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PraisonAI","publishedAt":"2026-08-25T14:56:59Z","exploitedKev":false,"fixedVersion":"4.6.58","vulnerableRange":"< 4.6.58"},{"id":"GHSA-ch89-h4r2-c8f8","title":"PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks","aliases":["CVE-2026-55540"],"summary":"### Summary\nPraisonAI's `praisonai.code` tool wrappers (exported as `CODE_TOOLS` for agents) expose a `workspace` setting that the module itself treats as a path-traversal **security boundary** \u2014 `read_file`, `write_file`, `apply_diff`, and `search_replace` explicitly call `is_pa","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PraisonAI","publishedAt":"2026-08-25T14:54:56Z","exploitedKev":false,"fixedVersion":"4.6.58","vulnerableRange":"< 4.6.58"},{"id":"GHSA-vg6p-v9vm-6fgj","title":"praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)","aliases":["CVE-2026-55524"],"summary":"The web_crawl tool performs its SSRF check only on the initial URL: it resolves the hostname once\nwith socket.gethostbyname and rejects private\/loopback\/link-local results. It then passes the URL to\na fetcher that uses httpx.Client(follow_redirects=True) - or urllib.request.urlop","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-08-25T14:43:19Z","exploitedKev":false,"fixedVersion":"1.6.58","vulnerableRange":"< 1.6.58"},{"id":"GHSA-7ww9-85pg-cv4x","title":"PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution","aliases":["CVE-2026-55534"],"summary":"### Summary\n\n  PraisonAI's `praisonai serve agents` command exposes `--api-key` as the documented\n  authentication control for production\/external deployments, but the configured key is not\n  enforced on the public agent invocation compatibility endpoints.\n\n  An operator can star","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"PraisonAI","publishedAt":"2026-08-25T14:42:25Z","exploitedKev":false,"fixedVersion":"4.6.58","vulnerableRange":">= 4.6.34 < 4.6.58"},{"id":"GHSA-x44h-65qv-cw74","title":"praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)","aliases":["CVE-2026-55526"],"summary":"### Summary\n\n`praisonaiagents\/tools\/spider_tools.py` contains an SSRF protection bypass. The function\n`_host_is_blocked()` validates URLs against a list of blocked IP literals and hostname\naliases, but **never performs DNS resolution**. Any hostname that resolves to a private or\n","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-08-25T14:37:26Z","exploitedKev":false,"fixedVersion":"1.6.58","vulnerableRange":"< 1.6.58"},{"id":"GHSA-7g3p-92qq-8wvh","title":"praisonaiagents: AgentServer declares auth_token but never enforces it on any route","aliases":["CVE-2026-55528"],"summary":"**Researcher:** Kai Aizen \u2014 SnailSploit (@SnailSploit), Adversarial & Offensive Security Research\n**Target:** https:\/\/github.com\/MervinPraison\/PraisonAI\n\n---\n\n**Package:** `praisonaiagents` on PyPI\n**Affected version (empirically tested):** 1.6.48\n**Component:** `praisonaiagents.","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-08-25T14:31:52Z","exploitedKev":false,"fixedVersion":"1.6.58","vulnerableRange":"< 1.6.58"},{"id":"GHSA-8hjw-25cg-g52h","title":"praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets","aliases":["CVE-2026-55523"],"summary":"## Summary\n\n`praisonaiagents.tools.web_crawl_tools.web_crawl()` validates the initial URL and blocks direct loopback\/private destinations by default, but the default httpx fallback still uses `httpx.Client(follow_redirects=True)` and does not revalidate redirect targets.\n\nAn atta","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-08-25T14:18:40Z","exploitedKev":false,"fixedVersion":"1.6.58","vulnerableRange":">= 1.5.128 < 1.6.58"},{"id":"GHSA-hxmv-c4g6-5fqc","title":"PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code","aliases":["CVE-2026-55522"],"summary":"## Summary\n\nPraisonAI's workflow include implementation implicitly imports and executes an included recipe's `tools.py` file even when the documented `tools.py` autoload opt-in is unset.\n\nThis bypasses the hardening added for the prior automatic `tools.py` RCE advisory family. A ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-08-25T14:15:27Z","exploitedKev":false,"fixedVersion":"1.6.58","vulnerableRange":">= 0.12.12 < 1.6.58"},{"id":"GHSA-5r34-2g38-6569","title":"praisonaiagents web_crawl vulnerable to SSRF via redirect-following","aliases":["CVE-2026-55525"],"summary":"### Summary\n`web_crawl` (an exported, model-callable tool) validates only the INITIAL URL's resolved IP against a private\/loopback blocklist, then fetches with `httpx.Client(follow_redirects=True)` and never re-validates redirect targets. \n\nAn attacker who controls the agent's cr","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"praisonaiagents","publishedAt":"2026-08-25T14:05:38Z","exploitedKev":false,"fixedVersion":"1.6.58","vulnerableRange":"< 1.6.58"},{"id":"GHSA-vp9c-2pjm-8925","title":"Duplicate Advisory: Allowlisted pickle loaders still permit code execution in current source","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-x99w-6fgc-pmfw. This link is maintained to preserve external references.\n\n## Original Description\nNLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pic","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-25T12:31:25Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.10.2"},{"id":"GHSA-gx65-c5hj-vpv5","title":"Duplicate Advisory: [CWE-502] Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-rhp5-r9x4-f5g2. This link is maintained to preserve external references.\n\n## Original Description\nNLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vul","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-25T03:32:11Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.9.4"},{"id":"GHSA-crp9-r7rq-c8cg","title":"Duplicate Advisory: pathsec SSRF protection can be bypassed when a proxy is configured","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-6ww7-3frv-cqxh. This link is maintained to preserve external references.\n\n## Original Description\nNLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlo","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-25T03:32:11Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.10.2"},{"id":"GHSA-54xp-3ww7-6wjg","title":"Duplicate Advisory: Uncontrolled search path when invoking the Graphviz 'dot' binary (CWE-426\/CWE-427)","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-6hwm-xvph-95vm. This link is maintained to preserve external references.\n\n## Original Description\nNLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-25T03:32:11Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.10.2"},{"id":"GHSA-89ff-m8wv-p99r","title":"Duplicate Advisory: GitPython: Incomplete unsafe_git_revision_options denylist omits --contents\/-S, enabling arbitrary file read via Repo.blame()","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-5xxx-qhh7-9287. This link is maintained to preserve external references.\n\n## Original Description\nGitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_o","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-08-25T03:32:11Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.58"},{"id":"GHSA-jx89-3qg8-p2mr","title":"Duplicate Advisory: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses (CWE-776)","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-97qj-x29f-37w7. This link is maintained to preserve external references.\n\n## Original Description\n\nNLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, whi","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-25T03:32:11Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.10.2"},{"id":"GHSA-6rj2-96f5-chj9","title":"Duplicate Advisory: GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-3wxw-xv34-2frg. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-08-25T03:32:11Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.58"},{"id":"GHSA-9557-234j-7rv9","title":"Duplicate Advisory: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-284h-m62q-gf8w. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during wri","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-08-25T03:32:10Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.58"},{"id":"GHSA-7r39-6q8m-qw68","title":"Duplicate Advisory: clone_from()\/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-8mcc-hrx5-hvxc. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing att","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-08-25T03:32:10Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.58"},{"id":"GHSA-crmc-f4m7-33fj","title":"Duplicate Advisory: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-7833-fr7j-v32q. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing a","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-08-25T03:32:10Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.58"},{"id":"GHSA-8vp7-8q4w-vv7m","title":"Duplicate Advisory: Grav: UserInterface offsetget\/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-3jhr-mxmx-38cx. This link is maintained to preserve external references.\n\n### Original Description\nGrav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-25T03:32:10Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 2.0.16"},{"id":"GHSA-crrc-vpp2-f5x7","title":"Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xjw5-q542-3vmr. This link is maintained to preserve external references.\n\n### Original Description\nGrav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuratio","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-25T03:32:10Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 2.0.16"},{"id":"GHSA-qh7h-6c7g-x8m6","title":"Duplicate Advisory: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9ccq-2jfg-qw33. This link is maintained to preserve external references.\n\n### Original Description\nGrav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Page","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-25T03:32:09Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 2.0.16"},{"id":"GHSA-mw85-cjh9-8hp7","title":"Duplicate Advisory: Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-p597-crqc-m349. This link is maintained to preserve external references.\n\n### Original Description\nGrav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sand","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-25T03:32:09Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 2.0.16"},{"id":"GHSA-896w-cw95-xq7w","title":"Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-jq29-c7v8-rg55. This link is maintained to preserve external references.\n\n### Original Description\nGrav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile(","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-25T03:32:09Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 2.0.16"},{"id":"GHSA-rj4c-4q9x-543x","title":"Duplicate Advisory: Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-47ch-6w46-6xm7. This link is maintained to preserve external references.\n\n### Original Description\nGrav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twi","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-25T03:32:09Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 2.0.16"},{"id":"GHSA-jm48-m3rr-9hgg","title":"3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation","aliases":["CVE-2026-55477"],"summary":"# Summary\n\nAn authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user runnin","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/mhsanaei\/3x-ui\/v3","publishedAt":"2026-08-24T21:05:14Z","exploitedKev":false,"fixedVersion":"3.3.1","vulnerableRange":"<= 3.3.0"},{"id":"GHSA-8jj7-4v57-frf5","title":"django CMS: Plugin move endpoint allows cyclic reparenting (DoS)","aliases":["CVE-2026-54623"],"summary":"### Summary\nThe `move_plugin` admin endpoint does not prevent a plugin from being   reparented under itself or one of its own descendants. Doing so creates a  cycle in the plugin tree, after which the recursive descendant\/ancestor SQL  queries loop without terminating, stalling t","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"django-cms","publishedAt":"2026-08-24T20:09:43Z","exploitedKev":false,"fixedVersion":"5.0.8","vulnerableRange":"< 5.0.8"},{"id":"GHSA-5x78-73v4-xg6w","title":"postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service","aliases":[],"summary":"A malicious, compromised, or man-in-the-middle server can supply an arbitrarily\nlarge SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client\nruns it inline with no upper bound, pinning a `tokio` worker thread for minutes\nper connection, possibly stalling the whole","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"postgres-protocol","publishedAt":"2026-08-24T19:43:31Z","exploitedKev":false,"fixedVersion":"0.6.12","vulnerableRange":">= 0.3.0 < 0.6.12"},{"id":"GHSA-xm98-3vcf-fph7","title":"mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server","aliases":["CVE-2026-53710"],"summary":"**Commit:** `f855e54d5b7bc1c91b977574a03b91eff6b86bb6`\n**Component:** `mcp-servers\/python\/python_sandbox_server\/src\/python_sandbox_server\/server_fastmcp.py`\n\n## Vulnerability\n\nRestrictedPython's sandbox in ContextForge's `python_sandbox_server` sub-project allows arbitrary Python","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mcp-contextforge-gateway","publishedAt":"2026-08-24T19:20:58Z","exploitedKev":false,"fixedVersion":"1.0.2","vulnerableRange":"<= 1.0.1"},{"id":"GHSA-p3f5-w63m-mxph","title":"Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-g84c-rxfj-3j2c. This link is maintained to preserve external references.\n\n## Original Description\nwebpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing t","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"webpack-dev-middleware","publishedAt":"2026-08-24T15:31:51Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 7.4.5"},{"id":"GHSA-892m-gcq8-2468","title":"Duplicate Advisory: Uncontrolled recursion DoS in JustHTML() via deeply nested HTML","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-v7cf-c9rm-wm3j. This link is maintained to preserve external references.\n\n### Original Description\njusthtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"justhtml","publishedAt":"2026-08-23T15:33:06Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 1.9.1"},{"id":"GHSA-8h9m-22mv-qv5r","title":"Duplicate Advisory: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-r6gq-whwq-mvg9. This link is maintained to preserve external references.\n\n## Original Description\nNLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() tha","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-22T15:31:04Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.9.3"},{"id":"GHSA-gf32-cmjh-8m9v","title":"Duplicate Advisory: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection","aliases":["CVE-2026-63310"],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-5wp5-5229-5g6q. This link is maintained to preserve external references.\n\n## Original Description\nNLTK before 3.9.3 fails to verify file integrity after downloading packages and before extra","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-22T15:31:03Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.9.2"},{"id":"GHSA-8w48-h75v-cxpv","title":"Duplicate Advisory: Security Report: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-x5ph-mj9p-rfr8. This link is maintained to preserve external references.\n\n## Original Description\nNLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpus","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-22T15:31:03Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.9.4"},{"id":"GHSA-qp76-pq9f-gr9m","title":"Duplicate Advisory: Stable FrameNet and NKJP readers parse outside-root XML in 3.9.4","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-568f-pv23-39p4. This link is maintained to preserve external references.\n\n## Original Description\nNLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader a","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-22T15:31:03Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.9.4"},{"id":"GHSA-cv2g-m8rr-888c","title":"Duplicate Advisory: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-rf74-v2fm-23pw. This link is maintained to preserve external references.\n\n## Original Description\nNLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-22T15:31:03Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.9.3"},{"id":"GHSA-79ph-w9m5-4v5m","title":"Duplicate Advisory: FileSystemPathPointer.open() sandbox check is dead code \u2014 arbitrary file read via file:\/\/ protocol","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-72r2-7mfr-5xr9. This link is maintained to preserve external references.\n\n## Original Description\nNLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sa","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-22T15:31:03Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.9.3"},{"id":"GHSA-8vh5-mgjj-w6hg","title":"Duplicate Advisory: [CWE-1188] Default ENFORCE=False Disables All pathsec Security Controls","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-p3m8-78j2-g5p3. This link is maintained to preserve external references.\n\n## Original Description\nNLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security val","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-22T15:31:03Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.9.4"},{"id":"GHSA-qq3h-cgj8-w3fx","title":"Duplicate Advisory: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-f833-7jw8-xwrv. This link is maintained to preserve external references.\n\n## Original Description\nNLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader t","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-22T15:31:03Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.10.0 < 3.10.2"},{"id":"GHSA-5gh2-94qg-qppq","title":"NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution","aliases":["CVE-2026-71513"],"summary":"NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attacker","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-22T15:31:03Z","exploitedKev":false,"fixedVersion":"3.10.3","vulnerableRange":">= 3.10.0 < 3.10.3"},{"id":"GHSA-66mm-25pp-rfff","title":"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions","aliases":["CVE-2026-77415"],"summary":"Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with\ncrafted expressions, due to:\n- overwriting `$clone` allowing mutation of objects via transforms (see\n[`evaluateTransformExpression`](https:\/\/github.com\/jsonata-js\/jsonata\/blob\/8ee4476f8a228bfc7a6297","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"jsonata","publishedAt":"2026-08-21T21:04:19Z","exploitedKev":false,"fixedVersion":"2.2.1","vulnerableRange":">= 2.0.0 < 2.2.1"},{"id":"GHSA-2943-5xfg-gq5f","title":"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions","aliases":["CVE-2026-77414"],"summary":"Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with\ncrafted expressions, due to a bypassable `hasOwnProperty` check in\n`environment.lookup`\nhttps:\/\/github.com\/jsonata-js\/jsonata\/blob\/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03\/src\/jsonata.js#L1863-L1871","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"jsonata","publishedAt":"2026-08-21T20:58:01Z","exploitedKev":false,"fixedVersion":"2.2.1","vulnerableRange":">= 2.0.0 < 2.2.1"},{"id":"GHSA-2cp2-2r3c-7p7r","title":"Hydra: hydra.utils.instantiate with untrusted config can lead to code execution","aliases":["CVE-2026-68508"],"summary":"## Summary\n\n`hydra.utils.instantiate()` resolves and calls Python objects from config. If an\napplication passes untrusted config to `instantiate()`, an attacker who controls\n`_target_` and its arguments can cause arbitrary code execution in the consuming\nprocess.\n\nHydra is not a ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"hydra-core","publishedAt":"2026-08-21T20:57:31Z","exploitedKev":false,"fixedVersion":"1.3.4","vulnerableRange":"<= 1.3.3"},{"id":"GHSA-5h77-88j3-r659","title":"YOURLS has stored XSS in referrer statistics chart via crafted Referer header","aliases":["CVE-2026-63135"],"summary":"### Summary\n\nYOURLS stores the HTTP `Referer` header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted `Referer` header to any existing short URL. When an authenticated administrat","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"yourls\/yourls","publishedAt":"2026-08-21T20:57:23Z","exploitedKev":false,"fixedVersion":"1.10.4","vulnerableRange":">= 1.5.1 <= 1.10.3"},{"id":"GHSA-8gq3-vp5j-2grp","title":"JSONata: Arbitrary Code Execution via crafted JSONata expressions","aliases":["CVE-2026-77413"],"summary":"## Impact\n\nBefore JSONata `2.2.0` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a missing `hasOwnProperty` check in the `lookup` function:\nhttps:\/\/github.com\/jsonata-js\/jsonata\/blob\/f9632e01e6e67d4f9f00593f9795420cb4b57f48\/src\/functions.js","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"jsonata","publishedAt":"2026-08-21T20:57:07Z","exploitedKev":false,"fixedVersion":"1.8.8","vulnerableRange":"<= 1.8.7"},{"id":"GHSA-xhj3-7xw9-vr34","title":"kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding","aliases":["CVE-2026-77354"],"summary":"### Summary\n\nAn uncontrolled resource consumption vulnerability in `openapi3filter` lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a `deepObject`-style query parameter whose schema contains an array (a n","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/getkin\/kin-openapi","publishedAt":"2026-08-21T20:56:56Z","exploitedKev":false,"fixedVersion":"0.142.0","vulnerableRange":">= 0.124.0 < 0.142.0"},{"id":"GHSA-x2rj-828p-hx9m","title":"Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing","aliases":["CVE-2026-61539"],"summary":"### Summary\n\nXinference used Python's unsafe `eval()` function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts ","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"xinference","publishedAt":"2026-08-21T20:56:37Z","exploitedKev":false,"fixedVersion":"2.7.0","vulnerableRange":"<= 2.5.0"},{"id":"GHSA-hrwp-4hh9-c8r8","title":"Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)","aliases":["CVE-2026-59989"],"summary":"## Summary\n\nThe Volt template compiler in Phalcon generates the PHP for the `join` filter by string-concatenating the filter's **raw template-literal argument bytes** with no escaping. The separator literal is dropped verbatim between two single quotes the compiler emits, and the","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"phalcon\/cphalcon","publishedAt":"2026-08-21T20:55:56Z","exploitedKev":false,"fixedVersion":"5.16.0","vulnerableRange":"<= 5.15.0"},{"id":"GHSA-mmfr-pmjx-hw9w","title":"kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart\/form-data body enables unauthenticated DoS","aliases":["CVE-2026-76905"],"summary":"### Summary\n\nA nil-pointer dereference in `openapi3filter.ConvertErrors` lets any unauthenticated client crash a server with a single HTTP request. When an application validates a `multipart\/form-data` request body and renders the resulting validation error through the library-pr","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/getkin\/kin-openapi","publishedAt":"2026-08-21T20:55:46Z","exploitedKev":false,"fixedVersion":"0.141.0","vulnerableRange":">= 0.10.0 < 0.141.0"},{"id":"GHSA-26w5-6g95-gj28","title":"Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion\/Creation","aliases":["CVE-2026-64679"],"summary":"### Summary\nAtlantis versions `>= 0.19.8` and `< 0.45.0` did not consistently validate user-controlled `workspace` values before using them to construct local workspace paths.\n\nA crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/runatlantis\/atlantis","publishedAt":"2026-08-21T20:55:33Z","exploitedKev":false,"fixedVersion":"0.45.0","vulnerableRange":">= 0.19.8 < 0.45.0"},{"id":"GHSA-cqmq-8755-7xvh","title":"Keystone vulnerable to `graphql.maxTake` bypass with negative `take`","aliases":["CVE-2026-63421"],"summary":"# Summary\nThe value of `graphql.maxTake` can be bypassed by providing a negative input.\nThis can be used to exceed the developer's intended `graphql.maxTake` value, allowing queries to return results in excess of the `graphql.maxTake` value set.\n\n# Impact\nThis affects any project","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@keystone-6\/core","publishedAt":"2026-08-21T20:55:11Z","exploitedKev":false,"fixedVersion":"6.5.3","vulnerableRange":"<= 6.5.2"},{"id":"GHSA-jg4p-g6xj-4qmf","title":"Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors","aliases":["CVE-2026-61824"],"summary":"## Summary\n\nAn Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a m","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"defuddle","publishedAt":"2026-08-21T20:54:56Z","exploitedKev":false,"fixedVersion":"0.19.1","vulnerableRange":"<= 0.19.0"},{"id":"GHSA-r5pq-6chh-j3xp","title":"Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter","aliases":["CVE-2026-63462"],"summary":"## Summary\n\nAn unauthenticated `POST` to any OpenAPI-validated endpoint, including the anonymous `POST \/edge\/validate` and `POST \/edge\/issue-token`, crashes the entire Unleash server with one request body of deeply-nested JSON.\n\nWhen request-body validation fails, Unleash builds ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"unleash-server","publishedAt":"2026-08-21T19:14:37Z","exploitedKev":false,"fixedVersion":"7.5.2","vulnerableRange":"< 7.5.2"},{"id":"GHSA-qx2g-xrx7-vfh8","title":" NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking","aliases":["CVE-2026-72818"],"summary":"The URLS regular expression in nltk\/tokenize\/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label sepa","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-21T00:31:23Z","exploitedKev":false,"fixedVersion":"3.10.1","vulnerableRange":"< 3.10.1"},{"id":"GHSA-fm29-4mq3-phg6","title":"Winter: ImportExportController AJAX handlers bypass granular import\/export permission gate","aliases":[],"summary":"### Impact\n\nAffected versions of Winter CMS did not enforce the `ImportExportController` behavior's granular access control on the handlers that actually perform the work.\n\nThe behavior supports per-operation access control through the `import[permissions]` and `export[permission","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"winter\/wn-backend-module","publishedAt":"2026-08-20T18:44:50Z","exploitedKev":false,"fixedVersion":"1.2.14","vulnerableRange":"<= 1.2.13"},{"id":"GHSA-8cfw-pcwh-v63w","title":"Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)","aliases":[],"summary":"### Impact\n\nAffected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to escape the Twig sandbox (\"safe mode\") that is meant to restrict what template code can do. Using any of the following permissions, an attacker can read and modif","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"winter\/wn-system-module","publishedAt":"2026-08-20T18:44:23Z","exploitedKev":false,"fixedVersion":"1.2.13","vulnerableRange":">= 1.2.7 < 1.2.13"},{"id":"GHSA-ghvf-qf6h-g8x5","title":"NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution","aliases":[],"summary":"## Executive Summary\n\nTwo vulnerabilities were identified and chained to achieve authenticated remote code execution\n\nThe first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk  including the application directory ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@nocobase\/server","publishedAt":"2026-08-20T18:42:21Z","exploitedKev":false,"fixedVersion":"2.1.5","vulnerableRange":"< 2.1.5"},{"id":"GHSA-23m2-mghx-vqmf","title":"Wagtail: Reflected XSS in dynamic image URL generator view","aliases":["CVE-2026-54263"],"summary":"### Impact\n\nA reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher priv","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"wagtail","publishedAt":"2026-08-20T18:40:26Z","exploitedKev":false,"fixedVersion":"7.3.3","vulnerableRange":">= 7.3 < 7.3.3"},{"id":"GHSA-7q96-f8xw-jv5j","title":"Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database","aliases":["CVE-2026-54245"],"summary":"### Summary\n\nA SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/fleetdm\/fleet","publishedAt":"2026-08-20T18:39:42Z","exploitedKev":false,"fixedVersion":"4.86.2","vulnerableRange":"< 4.86.2"},{"id":"GHSA-mrc5-3mm3-45c5","title":"Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)","aliases":["CVE-2026-54182"],"summary":"## Summary\n\n`Backpack\\CRUD\\Stats::makeCurlRequest` builds a shell command using unescaped input that originates from the HTTP `Host` header, then passes it to `exec()`. A specially crafted Host header can break out of the shell argument and cause the server to execute arbitrary O","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"backpack\/crud","publishedAt":"2026-08-20T18:38:55Z","exploitedKev":false,"fixedVersion":"4.1.72","vulnerableRange":">= 4.1.0 < 4.1.72"},{"id":"GHSA-vgmv-8xjc-6rch","title":"Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)","aliases":["CVE-2026-54180"],"summary":"## Summary\n\nBackpack CRUD's list and read operations correctly apply any query scopes\nregistered via `addClause()` \/ `addBaseClause()` (e.g. tenant isolation, user\nownership). However, the **Update**, **Delete**, and **Reorder** operations\nbypassed these scopes, fetching records ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"backpack\/crud","publishedAt":"2026-08-20T18:38:46Z","exploitedKev":false,"fixedVersion":"6.8.14","vulnerableRange":">= 6.0.0 < 6.8.14"},{"id":"GHSA-8xjm-wqrp-2f25","title":"Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk","aliases":["CVE-2026-54178"],"summary":"## Summary\n\n`HasUploadFields::uploadMultipleFilesToDisk` (in `src\/app\/Models\/Traits\/HasUploadFields.php`) reads file paths from the `clear_<attribute>[]` request input and deletes them from the configured storage disk **without verifying that the paths belong to the current model","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"backpack\/crud","publishedAt":"2026-08-20T18:38:39Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 5.0.0 < 6.0.0"},{"id":"GHSA-xpv2-hrfc-hw62","title":"Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment","aliases":["CVE-2026-54175"],"summary":"## Summary\n\nThe `MyAccountController::postAccountInfoForm` action bound to `POST \/admin\/edit-account-info` calls `$this->guard()->user()->update($request->except(['_token']))`. Because the controller uses `except(['_token'])` rather than `$request->validated()` or the restricted ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"backpack\/crud","publishedAt":"2026-08-20T18:38:26Z","exploitedKev":false,"fixedVersion":"6.8.11","vulnerableRange":"< 6.8.11"},{"id":"GHSA-v667-gc2r-2xm7","title":"Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication","aliases":["CVE-2026-55445"],"summary":"### Summary\n\nThe init guard middleware in Qinglong only checks `\/api\/user\/init` paths but not `\/open\/user\/init`, which is whitelisted from JWT authentication and rewritten to `\/api\/user\/init` after the guard has already passed, allowing unauthenticated admin credential reset on i","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@whyour\/qinglong","publishedAt":"2026-08-20T18:36:59Z","exploitedKev":false,"fixedVersion":"2.20.1","vulnerableRange":"< 2.20.1"},{"id":"GHSA-f5f4-3hh4-f54m","title":"Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header","aliases":["CVE-2026-54167"],"summary":"## Impact\n\nPipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint.\n\nAffected versions accepted the `X-GitHub-Enterprise-Host` request header as the GitHub Enterprise API host during GitHub Ap","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/openshift-pipelines\/pipelines-as-code","publishedAt":"2026-08-20T18:36:30Z","exploitedKev":false,"fixedVersion":"0.48.0","vulnerableRange":">= 0.43.0 < 0.48.0"},{"id":"GHSA-6wvw-vrw4-363w","title":"node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS","aliases":["CVE-2026-54156"],"summary":"**Summary**\nA process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash.\n\n**Affected versions:** <= 2.165.0\n**Tested version:** 2.165.0\n","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"node-opcua","publishedAt":"2026-08-20T18:35:41Z","exploitedKev":false,"fixedVersion":"2.166.0","vulnerableRange":"< 2.166.0"},{"id":"GHSA-mq36-523m-x7vv","title":"node-opcua missing nonce verification in UserNameIdentityToken authentication","aliases":["CVE-2026-54155"],"summary":"**Summary**\nA missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions.\n\n**Affected versions:**","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"node-opcua","publishedAt":"2026-08-20T18:35:33Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 2.165.0"},{"id":"GHSA-533j-2v4q-mw5h","title":"LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure","aliases":["CVE-2026-55253"],"summary":"# Executive Summary\n\nA NoSQL injection issue exists in the langgraph-checkpoint-mongodb and\nlanggraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods\naccept a filter parameter that is incorporated into MongoDB queries without sufficient validation.\n","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langgraph-checkpoint-mongodb","publishedAt":"2026-08-20T17:29:14Z","exploitedKev":false,"fixedVersion":"0.3.0","vulnerableRange":"< 0.3.0"},{"id":"GHSA-rrwh-6jrq-wp5v","title":"Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import","aliases":["CVE-2026-54061"],"summary":"## Summary\n\nDgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group\u2019s store","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/dgraph-io\/dgraph\/v25","publishedAt":"2026-08-20T17:29:00Z","exploitedKev":false,"fixedVersion":"25.3.5","vulnerableRange":"<= 25.3.4"},{"id":"GHSA-qqff-5854-px68","title":"vouch-proxy has an Unbounded Multipart Cookie Allocation DoS","aliases":["CVE-2026-55149"],"summary":"## Unbounded Multipart Cookie Allocation DoS in vouch-proxy\n\n### Summary\n\nvouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The `\/validate` endpoint parses the total cookie part count directly from the","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/vouch\/vouch-proxy","publishedAt":"2026-08-20T17:26:39Z","exploitedKev":false,"fixedVersion":"0.48.0","vulnerableRange":"<= 0.47.2"},{"id":"GHSA-rxjr-6c9q-h67x","title":"logto-tunnel serves files outside --experience-path via path traversal","aliases":["CVE-2026-63188"],"summary":"### Summary\n\n`@logto\/tunnel` serves custom sign-in experience files from the `--experience-path` directory. When the tunnel service is reachable, a requester can use `..\/` path segments in a static asset request to read files outside that directory that the CLI process can read.\n","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@logto\/tunnel","publishedAt":"2026-08-19T20:24:06Z","exploitedKev":false,"fixedVersion":"0.3.9","vulnerableRange":"<= 0.3.8"},{"id":"GHSA-vwg3-w8w3-pc79","title":"Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems","aliases":["CVE-2026-62673"],"summary":"## Summary\n\nThe default `.htaccess` shipped with Grav (and the reference `webserver-configs\/htaccess.txt`) contains security rules that block direct HTTP access to sensitive file types (`.yaml`, `.yml`, `.php`, `.json`, `.twig`, etc.) under `user\/` and `system\/vendor\/` directorie","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-19T19:32:38Z","exploitedKev":false,"fixedVersion":"2.0.4","vulnerableRange":"< 2.0.4"},{"id":"GHSA-3hgv-jr5j-cg9x","title":"Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover","aliases":["CVE-2026-55694"],"summary":"### Impact\nAn attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application.\n\n### Steps to Reproduce:\n1. Log in as a restricted user.\n2. Send a GET request to \/","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"snipe\/snipe-it","publishedAt":"2026-08-19T19:32:18Z","exploitedKev":false,"fixedVersion":"8.6.3","vulnerableRange":"< 8.6.3"},{"id":"GHSA-c6w2-j4wq-mvwg","title":"Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode","aliases":["CVE-2026-55643"],"summary":"### Impact\nDue to inconsistent authorization checks, a company-scoped user can bypass tenant boundaries to read, mutate, and soft-delete users who do not belong to any company (company_id = null). While direct instance authorization (isCurrentUserHasAccess) correctly denies acces","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"snipe\/snipe-it","publishedAt":"2026-08-19T19:32:11Z","exploitedKev":false,"fixedVersion":"8.6.3","vulnerableRange":"< 8.6.3"},{"id":"GHSA-p77j-g7h5-r2vw","title":"GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)","aliases":[],"summary":"GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain data and metadata for datasets they are not authorized to access.\n\n### Impact\n\n- **Private record metadata disclosure.** Record contact, keyword, and distribut","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"geolens","publishedAt":"2026-08-19T19:22:59Z","exploitedKev":false,"fixedVersion":"1.2.4","vulnerableRange":"< 1.2.4"},{"id":"GHSA-7m52-jw36-44r3","title":"MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter","aliases":["CVE-2026-53965"],"summary":"## Summary\n\nThe HTTP client transport in `mcp\/sdk` reads a Server-Sent-Events (SSE) response\nstream incrementally and appends each 4 KiB chunk to an in-memory buffer\n(`$this->sseBuffer .= $chunk;`) with **no upper bound**. The buffer is only ever\nflushed when an SSE event delimit","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"mcp\/sdk","publishedAt":"2026-08-19T19:17:49Z","exploitedKev":false,"fixedVersion":"0.7.1","vulnerableRange":">= 0.5.0 < 0.7.1"},{"id":"GHSA-w47q-945m-q9pc","title":"Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)","aliases":["CVE-2026-53964"],"summary":"### Impact\nA remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the co","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"document-merge-service","publishedAt":"2026-08-19T19:17:19Z","exploitedKev":false,"fixedVersion":"9.1.0","vulnerableRange":"< 9.1.0"},{"id":"GHSA-2xhg-73j7-rrgx","title":"Contentful MCP Server: export_space\/import_space tools pass LLM-controlled `host`\/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint","aliases":["CVE-2026-53957"],"summary":"### Summary\n\n`export_space` and `import_space` tools in `@contentful\/mcp-tools` accept LLM-controlled `host` and `proxy` parameters that are spread directly into the options object passed to `contentful-export` \/ `contentful-import`. These libraries pass the merged options \u2014 incl","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@contentful\/mcp-server","publishedAt":"2026-08-19T19:17:00Z","exploitedKev":false,"fixedVersion":"1.7.19","vulnerableRange":"< 1.7.19"},{"id":"GHSA-9gmc-jqmh-3rvm","title":"Copier has a trust-prefix bypass via path traversal that runs tasks unprompted","aliases":["CVE-2026-53951"],"summary":"# Copier: trust-prefix bypass via path traversal runs tasks unprompted\n\n### Summary\n\nIn copier `>= 9.5.0, <= 9.15.1`, the `trust` setting's prefix match\n(`copier\/_settings.py`) compares the template URL against a trusted prefix with\na raw `str.startswith` and **no path normalizat","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"copier","publishedAt":"2026-08-19T19:16:54Z","exploitedKev":false,"fixedVersion":"9.15.2","vulnerableRange":">= 9.5.0 <= 9.15.1"},{"id":"GHSA-rr55-jp92-8wp2","title":"claude-faf-mcp has an arbitrary local file read\/write via unconfined `path` argument in FAF tools","aliases":[],"summary":"### Summary\n`claude-faf-mcp` MCP tools accept a caller-controlled `path` argument and resolve it (`~` expansion + `path.resolve()`) straight into a filesystem read\/write **without confining it to a trusted project directory**. An absolute path or `..\/` traversal is resolved and u","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"claude-faf-mcp","publishedAt":"2026-08-19T19:15:25Z","exploitedKev":false,"fixedVersion":"5.7.2","vulnerableRange":"<= 5.7.1"},{"id":"GHSA-j4r7-8ph4-43g3","title":"faf-mcp has an arbitrary local file read\/write via unconfined `path` argument in FAF tools","aliases":[],"summary":"### Summary\n`faf-mcp` MCP tools accept a caller-controlled `path` argument and resolve it (`~` expansion + `path.resolve()`) straight into a filesystem read\/write **without confining it to a trusted project directory**. An absolute path or `..\/` traversal is resolved and used as-","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"faf-mcp","publishedAt":"2026-08-19T19:15:13Z","exploitedKev":false,"fixedVersion":"2.1.3","vulnerableRange":"<= 2.1.2"},{"id":"GHSA-cc2g-gq8c-r332","title":"grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools","aliases":[],"summary":"### Summary\nSeveral `grok-faf-mcp` MCP tools accept a caller-controlled `path` argument and resolve it (`~` expansion + `path.resolve()`) straight into a filesystem read **without confining it to a trusted project directory**. An absolute path or `..\/` traversal is resolved and u","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"grok-faf-mcp","publishedAt":"2026-08-19T19:15:01Z","exploitedKev":false,"fixedVersion":"1.5.3","vulnerableRange":"<= 1.5.2"},{"id":"GHSA-wv46-xpj8-pw53","title":"Duplicate Advisory: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-wvpp-8hx9-p66j. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_optio","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-08-19T15:32:33Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.57"},{"id":"GHSA-9xwc-vwww-qqmw","title":"Duplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-32r8-5843-4qw2. This link is maintained to preserve external references.\n\n### Original Description\nVikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing p","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-08-19T15:32:33Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 2.4.0"},{"id":"GHSA-298h-jpq4-m665","title":"Duplicate Advisory: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-9rj7-rf2p-w77r. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that for","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-08-19T15:32:33Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.57"},{"id":"GHSA-7jx3-jqcp-hhgc","title":"Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree\/reset\/merge_tree enables arbitrary file overwrite","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-4gmw-gg2m-w46p. This link is maintained to preserve external references.\n\n## Original Description\nGitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexF","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-08-19T15:32:33Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.57"},{"id":"GHSA-3vrx-526r-64rm","title":"Duplicate Advisory: GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-hmq2-w58f-27jc. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing a","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-08-19T15:32:33Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.57"},{"id":"GHSA-w672-239g-c3gr","title":"Duplicate Advisory: GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-hh9p-6wh2-4mfc. This link is maintained to preserve external references.\n\n## Original Description\nGitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-08-19T15:32:33Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.57"},{"id":"GHSA-hfg8-hc9c-6c3h","title":"moby\/go-archive: Crafted tar archive can write outside the extraction directory","aliases":["CVE-2026-17106"],"summary":"### Summary\nThe tar extraction routines in `moby\/go-archive` (`Unpack`, `UnpackLayer`, `Untar`\/`UntarUncompressed`, and the `ApplyLayer` helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files **outside** the int","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/moby\/go-archive","publishedAt":"2026-08-18T21:17:29Z","exploitedKev":false,"fixedVersion":"0.3.0","vulnerableRange":"< 0.3.0"},{"id":"GHSA-7gww-x7fh-jf9j","title":"LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page","aliases":[],"summary":"### Summary\nThe Oxidized integration URL (`oxidized.url`) is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields (`name`, `ip`, `model`, `author`, commit message) into HTML without `htmlspecialchars()`. An admin pointing the ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"librenms\/librenms","publishedAt":"2026-08-18T21:17:23Z","exploitedKev":false,"fixedVersion":"26.7.0","vulnerableRange":"< 26.7.0"},{"id":"GHSA-pxmc-2ffp-8j67","title":"Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it","aliases":["CVE-2026-71417"],"summary":"## Summary\n\nRepo under test: https:\/\/github.com\/Netflix\/lemur\n\n`PUT \/api\/1\/certificates\/<id>\/revoke` authorizes the caller against the *Lemur database row* (creator == current user, or `CertificatePermission` over the row's roles) rather than the underlying CA-side certificate id","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lemur","publishedAt":"2026-08-18T20:51:48Z","exploitedKev":false,"fixedVersion":"1.9.3","vulnerableRange":"<= 1.9.2"},{"id":"GHSA-cfh6-pv5c-38jv","title":"Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates","aliases":["CVE-2026-71308"],"summary":"## Summary\n\nRepo under test: https:\/\/github.com\/Netflix\/lemur\n\nThe certificate create and upload endpoints accept a `replaces[]` (alias `replacements`) array that is resolved to live `Certificate` ORM objects with no ownership or `CertificatePermission` check on the referenced ce","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lemur","publishedAt":"2026-08-18T20:51:33Z","exploitedKev":false,"fixedVersion":"1.9.3","vulnerableRange":">= 0.5.0 <= 1.9.2"},{"id":"GHSA-6c8m-q6g9-vrw3","title":"Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password \/ private-key passphrase) via the destinations API","aliases":["CVE-2026-71307"],"summary":"### Summary\nLemur's destination read endpoints -- `GET \/api\/1\/destinations` and `GET \/api\/1\/destinations\/<id>` -- return the full set of stored plugin option values to any authenticated user, with no authorization check and no redaction of secret-bearing options. The sibling writ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lemur","publishedAt":"2026-08-18T20:51:26Z","exploitedKev":false,"fixedVersion":"1.9.3","vulnerableRange":"< 1.9.3"},{"id":"GHSA-v5rc-cpwc-cfpr","title":"Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist","aliases":["CVE-2026-71303"],"summary":"### Summary\n\nThe fix for GHSA-v2wp-frmc-5q3v added `_validate_acme_url()` to reject `acme_url` values not in `ACME_DIRECTORY_HOST_ALLOWLIST`, but the validation is only called at **authority creation time** (POST). The authority **update** endpoint (`PUT \/api\/1\/authorities\/<id>`)","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lemur","publishedAt":"2026-08-18T20:51:21Z","exploitedKev":false,"fixedVersion":"1.9.3","vulnerableRange":"<= 1.9.2"},{"id":"GHSA-xpmj-wjcp-6pww","title":"Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs","aliases":["CVE-2026-70666"],"summary":"### Summary\nThe ACME client (used to issue certificates from Let's Encrypt \/ Google Public CA \/ private ACME CAs) connects to an `acme_url`, then issues requests to URLs that the **ACME server returns** in its directory\/order\/authorization\/finalize responses - this is the classic","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"lemur","publishedAt":"2026-08-18T20:51:07Z","exploitedKev":false,"fixedVersion":"1.9.3","vulnerableRange":"<= 1.9.2"},{"id":"GHSA-7788-ghfq-c6mh","title":"Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints","aliases":["CVE-2026-62988"],"summary":"## Summary\n\nSeveral Froxlor API command classes return sensitive authentication material in JSON API responses. The affected endpoints retrieve full database rows using `SELECT *`, `SELECT alias.*`, or equivalent full-row queries, then return the results directly through `$this->","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"froxlor\/froxlor","publishedAt":"2026-08-18T20:48:35Z","exploitedKev":false,"fixedVersion":"2.3.8","vulnerableRange":"< 2.3.8"},{"id":"GHSA-w27m-rmmf-g5w4","title":"Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration","aliases":["CVE-2026-54348"],"summary":"### Summary\n\nA second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to store a crafted SQL payload in the `panel_admins.ip` column via the `Admins.add` or `Admins.update` endpoint. The payload executes as a UNION-based SQL injectio","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"froxlor\/froxlor","publishedAt":"2026-08-18T20:47:59Z","exploitedKev":false,"fixedVersion":"2.3.8","vulnerableRange":"< 2.3.8"},{"id":"GHSA-43gm-9rr3-cx7g","title":"Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover","aliases":["CVE-2026-54347"],"summary":"### Summary\n\nA stored Cross-Site Scripting (XSS) vulnerability in Froxlor's DNS editor allows an authenticated user with DNS editor access (customer role) to inject arbitrary JavaScript into any administrator's browser session. When an administrator views the DNS configuration of","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"froxlor\/froxlor","publishedAt":"2026-08-18T20:47:53Z","exploitedKev":false,"fixedVersion":"2.3.8","vulnerableRange":"<= 2.3.7"},{"id":"GHSA-59xm-4m8c-g3xj","title":"MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install\/Uninstall","aliases":["CVE-2026-55224"],"summary":"## Path Traversal via Unsanitized Identifier in Plugin Install\/Uninstall\n\n### Summary\nThe app-store plugin service concatenates unsanitized user-supplied `identifier` values directly into file system paths. An attacker can use path traversal sequences (e.g., `..\/`) to read, insta","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"mineadmin\/mineadmin","publishedAt":"2026-08-18T20:40:37Z","exploitedKev":false,"fixedVersion":"3.2.0-alpha.2","vulnerableRange":"< 3.2.0-alpha.2"},{"id":"GHSA-wg9g-w2j2-8pgr","title":"MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files","aliases":[],"summary":"### Summary\n\nThe `NumpyReader` class in `monai\/data\/image_reader.py` unconditionally uses `np.load(name, allow_pickle=True)` (line 1276), enabling arbitrary code execution when loading a crafted `.npy` or `.npz` file. This affects all MONAI versions up to and including the latest","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"monai","publishedAt":"2026-08-18T20:22:42Z","exploitedKev":false,"fixedVersion":"1.6.0","vulnerableRange":"< 1.6.0"},{"id":"GHSA-rghg-q7wp-9767","title":"MONAI vulnerable to OS command injection","aliases":[],"summary":"### Comment from JPCERT\/CC\nWe are submitting the report again as we have yet to receive\nany responses from you after submitting it on February 5 and March 11.\n\nIt would be greatly appreciated if you could send us a message\nafter confirming it so that we can follow up the case by ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"MONAI","publishedAt":"2026-08-18T20:22:38Z","exploitedKev":false,"fixedVersion":"1.6.0","vulnerableRange":"< 1.6.0"},{"id":"GHSA-qxq5-qhx6-94qw","title":"Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming      patch","aliases":[],"summary":"## Summary\n\n  GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in\n  `algo_from_pickle()` was fixed in v1.5.2. However, `monai\/auto3dseg\/utils.py`\n  has not been modified since 2024-07-12 \u2014 18 months before v1.5.2 was released\n  (2026-01-29). All three `pickle.l","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"monai","publishedAt":"2026-08-18T20:22:30Z","exploitedKev":false,"fixedVersion":"1.6.0","vulnerableRange":"< 1.6.0"},{"id":"GHSA-pcw8-m77r-2528","title":"jmespath.php has CompilerRuntime code injection via unescaped function names","aliases":["CVE-2026-54133"],"summary":"## Impact\n\n`mtdowling\/jmespath.php` can generate and execute attacker-controlled PHP code when `JmesPath\\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escapi","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"mtdowling\/jmespath.php","publishedAt":"2026-08-18T20:16:38Z","exploitedKev":false,"fixedVersion":"2.9.1","vulnerableRange":"< 2.9.1"},{"id":"GHSA-rcr2-hggw-43wm","title":"surfio has an out-of-bounds read","aliases":["CVE-2026-55211"],"summary":"### Impact\nPrior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service.\n\n\n### Patches\nThe bug has been ","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"surfio","publishedAt":"2026-08-18T20:12:55Z","exploitedKev":false,"fixedVersion":"0.0.19","vulnerableRange":"< 0.0.19"},{"id":"GHSA-pr85-w493-9w3x","title":"resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read","aliases":["CVE-2026-55209"],"summary":"### Impact\nPrior to version 6.2.9 resdata would not correctly validate input in GRDECL files. The severity rating assumes that resdata is used to parse untrused files in a networking context such as a webservice.\n\n### Patches\nThe bug has been patched starting with version 6.2.9.","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"resdata","publishedAt":"2026-08-18T20:11:04Z","exploitedKev":false,"fixedVersion":"6.2.9","vulnerableRange":"< 6.2.9"},{"id":"GHSA-c7hr-448w-65px","title":"MeshCentral has unsanitized data fields","aliases":[],"summary":"### Description\n\nA rogue or compromised MeshAgent can inject arbitrary HTML\/JavaScript via the osdesc (OS description) field in its coreinfo message. The server stores this value with zero HTML sanitization (meshagent.js:1903 only checks typeof == 'string'). When an admin views t","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"meshcentral","publishedAt":"2026-08-18T20:09:35Z","exploitedKev":false,"fixedVersion":"1.1.60","vulnerableRange":"< 1.1.60"},{"id":"GHSA-p23g-mvhj-jh3j","title":"GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster\/vector tile data","aliases":["CVE-2026-55178"],"summary":"### Summary\n\nMultiple GeoLens read\/link endpoints authorized only the resource named in the\nrequest URL (a map, a VRT, a source dataset, an AI request) and failed to\nre-authorize a **second, caller-influenced dataset** that the request reached\nthrough a relationship, layer refere","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@geolens\/sdk","publishedAt":"2026-08-18T18:00:07Z","exploitedKev":false,"fixedVersion":"1.2.3","vulnerableRange":"< 1.2.3"},{"id":"GHSA-c9fv-cgmm-2wg7","title":"LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module","aliases":["CVE-2026-55182"],"summary":"### Summary\nA vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands.\n\n### Details\nThe vulnerability i","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"librenms\/librenms","publishedAt":"2026-08-18T17:59:56Z","exploitedKev":false,"fixedVersion":"26.5.0","vulnerableRange":">= 21.6.0 < 26.5.0"},{"id":"GHSA-2mf3-mr2r-r4vf","title":"@rhinostone\/swig: arbitrary local file read via include\/extends path traversal","aliases":[],"summary":"### Overview\n\n`@rhinostone\/swig` is a maintained fork of the abandoned `swig` template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 \/ GHSA-2rq5-699j-x7p6. The `{% include %}`, `{% extends %}`, and `{% import %}` tags resolve their ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@rhinostone\/swig","publishedAt":"2026-08-18T16:31:16Z","exploitedKev":false,"fixedVersion":"2.7.1","vulnerableRange":"< 2.7.1"},{"id":"GHSA-m97h-2qj3-5773","title":"Duplicate Advisory: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xhfv-7758-r9hx. This link is maintained to preserve external references.\n\n### Original Description\nGrav before 2.0.14 fails to guard the access field in the core group blueprint with the req","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-18T12:31:22Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 2.0.14"},{"id":"GHSA-9pr6-8r9w-wvmj","title":"Duplicate Advisory: Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-vfmf-q6x9-cw96. This link is maintained to preserve external references.\n\n### Original Description\nGrav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() ","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-18T12:31:22Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 2.0.15"},{"id":"GHSA-fwwx-3362-3947","title":"Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-f8wv-xp27-6gq7. This link is maintained to preserve external references.\n\n### Original Description\nGrav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-18T12:31:22Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 2.0.15"},{"id":"GHSA-2rhw-8953-48q3","title":"Duplicate Advisory: Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-4v9q-p283-qc2m. This link is maintained to preserve external references.\n\n### Original Description\nGrav before 2.0.15 contains a path traversal vulnerability in the static asset server withi","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-18T12:31:21Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 2.0.15"},{"id":"GHSA-69jp-f2p8-9vrg","title":"Duplicate Advisory: 17 block metadata\/content endpoints in kernel\/api\/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-4vpg-gwqq-w44c. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan before v3.7.4 is missing authorization checks in 17 block metadata\/content endpoints ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-18T12:31:21Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 3.7.4"},{"id":"GHSA-gqch-g4w5-7qcw","title":"MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id","aliases":["CVE-2026-69148"],"summary":"### Summary\n\nThe `_validate_source_run` and `_validate_source_model` functions in `mlflow\/server\/handlers.py` verify that a model version source path is within the artifact directory of a specified run or logged model, but do not check whether the caller has READ permission on th","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"mlflow","publishedAt":"2026-08-17T21:59:09Z","exploitedKev":false,"fixedVersion":"3.15.0","vulnerableRange":"< 3.15.0"},{"id":"GHSA-7gwp-5pfp-969j","title":"MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)","aliases":["CVE-2026-64849"],"summary":"### Summary\nThe default MLflow Tracking Server (`mlflow server`, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous `POST \/api\/2.0\/mlflow\/webhooks\/{id}\/test` endpoint that returns the upstream response statu","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mlflow","publishedAt":"2026-08-17T21:58:51Z","exploitedKev":true,"fixedVersion":"3.15.0","vulnerableRange":">= 3.3.0 < 3.15.0"},{"id":"GHSA-8g4w-4ffg-8vgx","title":"9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint","aliases":["CVE-2026-56677"],"summary":"### Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability exists in the 9Router dashboard via the `\/api\/auth\/oidc\/test` endpoint. The application accepts a user-controlled URL string through the `issuerUrl` parameter and performs an outbound HTTP request without validating ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"9router","publishedAt":"2026-08-17T21:58:43Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 0.5.4"},{"id":"GHSA-j659-8xh6-5pq5","title":"atomic-agents-stack: Parallel helper\/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard","aliases":[],"summary":"`_estimate_batch_cost` (`atomic_agents\/agent.py`) looks up the per-model output price with `PRICING.get(model, {})`, returning 0.0 for any model not in the hardcoded pricing table. `_check_batch_reservation` then early-returns when the reservation is <= 0, skipping the batch rese","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"atomic-agents-stack","publishedAt":"2026-08-17T21:50:01Z","exploitedKev":false,"fixedVersion":"1.1.0","vulnerableRange":"<= 1.0.0"},{"id":"GHSA-xhcr-cqfr-m3hv","title":"atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)","aliases":[],"summary":"The HTTP MCP server-registry backend factory (`atomic_agents\/mcp_registry\/http.py`, `make_http_mcp_server_registry_backend_from_url`) accepts both `http` and `https` schemes. Catalog entries carry `command`\/`args` that are type-validated but content-unrestricted, and are later sp","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"atomic-agents-stack","publishedAt":"2026-08-17T21:49:55Z","exploitedKev":false,"fixedVersion":"1.1.0","vulnerableRange":"<= 1.0.0"},{"id":"GHSA-fhgh-wq4q-r37x","title":"uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set","aliases":[],"summary":"## Summary\n\nThe sigstore check on `metadata.json` is gated on the wrong side of the condition. `LoadMetadata` in `internal\/config\/update.go:81` verifies the bundle only when `UNIGET_IGNORE_METADATA_SIGNATURE` is non-empty, so in a normal run, where nobody sets that variable, the ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"gitlab.com\/uniget-org\/cli","publishedAt":"2026-08-17T17:50:34Z","exploitedKev":false,"fixedVersion":"0.28.9","vulnerableRange":">= 0.27.4 < 0.28.9"},{"id":"GHSA-prg7-hcfm-mfcr","title":"sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)","aliases":["CVE-2026-59893"],"summary":"### Summary\n\nsqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at `sqlparse\/keywords.py:33` uses a backreference (`\\1`) to match closing dollar-quote delimiters, causing O(n\u00b2) CPU complexity wh","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"sqlparse","publishedAt":"2026-08-17T17:49:55Z","exploitedKev":false,"fixedVersion":"0.6.0","vulnerableRange":"<= 0.5.6.dev0"},{"id":"GHSA-pwgv-4x5q-6m9f","title":"sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth\/token caps trigger","aliases":["CVE-2026-54284"],"summary":"### Summary\n\n`sqlparse` ships hard limits (`MAX_GROUPING_DEPTH=100`, `MAX_GROUPING_TOKENS=10000`) intended to bound parsing work on attacker-supplied SQL, but the path that *reaches* those limits is itself `O(n*depth)` per token-group construction. A ~1-2 KB SQL payload (e.g. `SE","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"sqlparse","publishedAt":"2026-08-17T17:49:47Z","exploitedKev":false,"fixedVersion":"0.6.0","vulnerableRange":"<= 0.5.5"},{"id":"GHSA-2jp7-wwpg-3p9w","title":"Etherpad has stored XSS in HTML export via unescaped attribute-pool values","aliases":["CVE-2026-55090"],"summary":"Fix: PR #7905 (ether\/etherpad).\n\n`getHTMLFromAtext` in `src\/node\/utils\/ExportHtml.ts` interpolates values from the `exportHtmlAdditionalTagsWithData` plugin hook into `span data-<k>=\"<v>\"` without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, whic","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ep_etherpad-lite","publishedAt":"2026-08-17T17:49:38Z","exploitedKev":false,"fixedVersion":"3.3.0","vulnerableRange":"<= 1.8.14"},{"id":"GHSA-v836-6xw4-9cx3","title":"vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass","aliases":[],"summary":"### Summary:\n\nThe `bufferAllocLimit` defense (GHSA-6785-pvv7-mvg7) can be completely bypassed using `ArrayBuffer`, `SharedArrayBuffer`, or any `TypedArray` constructor. These allocate identical host-process RSS through the same V8\/libuv C++ allocation path as `Buffer.alloc` but a","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-08-17T17:32:57Z","exploitedKev":false,"fixedVersion":"3.11.6","vulnerableRange":"<= 3.11.5"},{"id":"GHSA-m5w8-4gq2-6f8x","title":"vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` \u2014 process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)","aliases":[],"summary":"# NodeVM `builtin: ['*']` exposes `os` and `dns` \u2014 process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)\n\n**CWE**: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) chained with CWE-732 (Incorrect Permission Ass","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-08-17T17:32:47Z","exploitedKev":false,"fixedVersion":"3.11.6","vulnerableRange":"<= 3.11.5"},{"id":"GHSA-cfcw-xp6x-25gj","title":"vm2: Sandbox Breakout Using Dangerous Host Proto Mutators","aliases":["CVE-2026-47698"],"summary":"### Summary\n\nVM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.\n\n### Details\n\nThe fix for https:\/\/github.com\/patriksimek\/vm2\/security\/advisories\/GHSA-v6mx-","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-08-17T17:32:41Z","exploitedKev":false,"fixedVersion":"3.11.6","vulnerableRange":"<= 3.11.5"},{"id":"GHSA-m283-3h24-438v","title":"VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE","aliases":["CVE-2026-47686"],"summary":"**Affected:** vm2 <= 3.11.3\n**CVSS 3.1:** 9.9 HIGH (CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:H\/I:H\/A:H)\n**CWE:** CWE-693 (Protection Mechanism Failure)\n**Prerequisite:** Embedder exposes a host function that throws an Error with `.cause` referencing a powerful host object (e.g., `proce","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-08-17T17:32:34Z","exploitedKev":false,"fixedVersion":"3.11.6","vulnerableRange":"<= 3.11.5"},{"id":"GHSA-gmc2-2x9w-cgh9","title":"vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike","aliases":["CVE-2026-47683"],"summary":"## Summary\n\nvm2 bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike\n\nThe `bufferAllocLimit` option introduced in 3.11.0 (GHSA-6785-pvv7-mvg7) caps host-side Buffer allocations driven by sandbox code, the way embedders opt into `timeout`. The cap wraps `Buffer","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"vm2","publishedAt":"2026-08-17T17:32:10Z","exploitedKev":false,"fixedVersion":"3.11.6","vulnerableRange":"<= 3.11.5"},{"id":"GHSA-f2ff-p2ww-7p4p","title":"sqlparse: Quadratic O(n\u00b2) DoS in group_comments","aliases":["CVE-2026-71491"],"summary":"### Summary\nA comment-only statement (`-- c\\n`*n) may cause a Denial of Service (DoS).\n\n### Details\nLocation: [sqlparse\/engine\/grouping.py:331-341](https:\/\/github.com\/andialbrecht\/sqlparse\/blob\/f80af6a4007f11ada847218df8c29dc859238290\/sqlparse\/engine\/grouping.py#L332) (`group_com","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"sqlparse","publishedAt":"2026-08-17T17:21:00Z","exploitedKev":false,"fixedVersion":"0.6.0","vulnerableRange":"<= 0.5.5"},{"id":"GHSA-59fj-m2j6-hcxh","title":"Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)","aliases":["CVE-2026-68519"],"summary":"## Summary\nIn Glances 4.5.5 the `--disable-config-exec` flag was extended (GHSA-3vwc-qwhc-3mj7) to stop `secure_popen()` from\ninterpreting the shell operators `&&`, `|` and `>` in **AMP** command values taken from the configuration file. The\nhardening was not applied to the **on-","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"glances","publishedAt":"2026-08-17T17:20:37Z","exploitedKev":false,"fixedVersion":"4.5.6","vulnerableRange":"<= 4.5.5"},{"id":"GHSA-73wf-9vmv-5pv9","title":"Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') \u2192 OS command injection","aliases":["CVE-2026-62982"],"summary":"## Summary\nCVE-2026-32608 (\"Command Injection via Process Names in Action Command Templates\") was fixed (commit `5680a5d`) by adding `_sanitize_mustache_dict`, which replaces the shell operators `&&`, `|`, `>>`, `>` with spaces in the values rendered into action command templates","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"glances","publishedAt":"2026-08-17T17:20:24Z","exploitedKev":false,"fixedVersion":"4.5.6","vulnerableRange":">= 4.5.2 < 4.5.6"},{"id":"GHSA-qcpp-8x79-hhp3","title":"Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction","aliases":["CVE-2026-68518"],"summary":"### Summary\n\nThe Glances action system lets an administrator configure shell commands that run\nwhen a monitoring threshold is crossed. The command is a Mustache template whose\nvariables are filled with runtime stat fields such as a process name, a container\nname or a filesystem m","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"glances","publishedAt":"2026-08-17T16:36:37Z","exploitedKev":false,"fixedVersion":"4.5.6","vulnerableRange":"<= 4.5.5"},{"id":"GHSA-8r8v-xf7q-rcpr","title":"New API: Integer overflow in quota billing yields negative charges (self-crediting)","aliases":["CVE-2026-71479"],"summary":"## Summary\n\nMultiple billing paths multiplied **user-controlled quantity parameters** into the quota calculation without an upper bound or overflow-safe integer conversion. A crafted extreme value (e.g. image `n = 18446744073686646784`, a wrapped-negative accepted by a `*uint` fi","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/QuantumNous\/new-api","publishedAt":"2026-08-17T16:36:13Z","exploitedKev":false,"fixedVersion":"1.0.0-rc.18","vulnerableRange":"<= 1.0.0-rc.17"},{"id":"GHSA-v828-m3pf-vq9q","title":"New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging","aliases":["CVE-2026-64868"],"summary":"## Summary\n\nUnauthenticated payment webhook endpoints could read and log the entire request body before validating the webhook signature. When a payment webhook was enabled, an unauthenticated attacker could send oversized requests to public callback endpoints and force excessive","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/QuantumNous\/new-api","publishedAt":"2026-08-17T16:35:58Z","exploitedKev":false,"fixedVersion":"1.0.0-rc.11","vulnerableRange":"< 1.0.0-rc.11"},{"id":"GHSA-6x2c-phff-wx57","title":"New API: User List API Leaks Root User Access Token Leading to Privilege Escalation","aliases":["CVE-2026-64859"],"summary":"## Vulnerability Information\n\n- **Product**: new-api\n- **Affected versions**: versions before `v1.0.0-rc.7` that serialize `User.AccessToken` as `access_token`; the issue was confirmed in `v0.12.14`\n- **Patched version**: `v1.0.0-rc.7`\n- **Fixed commit**: `0936e2504655a5cbf7bc3c3","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/QuantumNous\/new-api","publishedAt":"2026-08-17T16:35:50Z","exploitedKev":false,"fixedVersion":"1.0.0-rc.7","vulnerableRange":"< 1.0.0-rc.7"},{"id":"GHSA-7pqw-9j4j-h8q3","title":"extract-zip allows arbitrary file writes through symlink archive entries","aliases":["CVE-2026-19693"],"summary":"extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file -","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"extract-zip","publishedAt":"2026-08-17T15:30:40Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 2.0.1"},{"id":"GHSA-m44r-7c5h-m6mj","title":"Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage","aliases":["CVE-2026-53728"],"summary":"## Summary\n\nThe external identity provider callback at `GET \/auth\/external` accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum `lo","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@medplum\/core","publishedAt":"2026-08-17T13:36:17Z","exploitedKev":false,"fixedVersion":"5.1.6","vulnerableRange":"<= 5.1.5"},{"id":"GHSA-ggr8-5vv4-36mx","title":"DeepmergeTS has stack exhaustion when merging recursive object graphs","aliases":["CVE-2026-40345"],"summary":"### Summary\n\n`deepmerge()` and `deepmergeInto()` can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws `RangeError: Maximum call stack size exceeded`.\n\n### Details\n\nR","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"deepmerge-ts","publishedAt":"2026-08-17T13:32:13Z","exploitedKev":false,"fixedVersion":"8.0.0","vulnerableRange":"< 8.0.0"},{"id":"GHSA-hg5w-8ppq-wpjq","title":"Duplicate Advisory: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream, defeating the fix for GHSA-xp2m-98x8-rpj6","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-c8w8-3pqp-wr83. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocke","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-16T00:31:28Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 3.7.4"},{"id":"GHSA-49mq-fc6q-3h46","title":"Token Optimizer MCP: OS command injection in smart_user via username in get-user-info","aliases":["CVE-2026-55157"],"summary":"### Summary\n\n`token-optimizer-mcp` is vulnerable to OS command injection in the `smart_user` tool.\n\nThe `get-user-info` operation accepts a user-controlled `username` argument and later interpolates it into a shell command executed through `execAsync()`:\n\n```ts\ngetent passwd \"${u","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@ooples\/token-optimizer-mcp","publishedAt":"2026-08-14T21:42:06Z","exploitedKev":false,"fixedVersion":"5.1.0","vulnerableRange":"< 5.1.0"},{"id":"GHSA-2j9v-p4xj-cjw2","title":"Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket","aliases":["CVE-2026-53657"],"summary":"### Impact\nOn an instance of Lima running with `qemu` driver, an arbitrary user in the VM could access `\/run\/lima-guestagent.sock` when the guest agent is enabled.\n\nThis could result in running an arbitrary command with the root privileges in the VM (**not on the host**), as `lim","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/lima-vm\/lima\/v2","publishedAt":"2026-08-14T19:24:33Z","exploitedKev":false,"fixedVersion":"2.1.3","vulnerableRange":"<= 2.1.2"},{"id":"GHSA-4x9g-vw65-vvf9","title":"Grav: Unauthenticated denial of service via unbounded image derivative dimensions","aliases":["CVE-2026-53653"],"summary":"### Summary\nAn unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimensions. One request drives a worker to several gigabytes of RAM and tens of seconds of CPU. A few concurrent requests take the host down.\n\n### Details\n`Grav::fal","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-14T19:23:38Z","exploitedKev":false,"fixedVersion":"2.0.0-rc.8","vulnerableRange":">= 2.0.0-beta.1 < 2.0.0-rc.8"},{"id":"GHSA-5fpj-28rv-84r7","title":"Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist","aliases":["CVE-2026-35219"],"summary":"## Summary\n\nBudibase automation steps (outgoing webhook, Zapier, n8n, Slack, Discord, Make.com) make server-side HTTP requests to user-provided URLs using `node-fetch` directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@budibase\/server","publishedAt":"2026-08-14T19:18:47Z","exploitedKev":false,"fixedVersion":"3.41.3","vulnerableRange":"< 3.41.3"},{"id":"GHSA-29rf-f4vv-pvq6","title":"Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts","aliases":["CVE-2026-35511"],"summary":"The OAuth callback handler links incoming OAuth identities (Google, GitHub, etc.) to existing accounts matched by email address without verifying that the existing account's email was verified by its original owner. An attacker who pre-registers with a victim's email address (wit","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/authorizerdev\/authorizer","publishedAt":"2026-08-14T15:36:15Z","exploitedKev":false,"fixedVersion":"0.0.0-20260807033110-66fe488fd2a4","vulnerableRange":"< 0.0.0-20260807033110-66fe488fd2a4"},{"id":"GHSA-wvxr-6v52-gfmh","title":"Duplicate Advisory: Remote code execution via .zip file upload in Grav CMS","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-r94f-hx44-8jqf. This link is maintained to preserve external references.\n\n### Original Description\nGrav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects p","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-14T12:31:25Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 2.0.13"},{"id":"GHSA-q6g5-m978-c6v9","title":"Duplicate Advisory: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected\/forbidden documents (publish mode)","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-mw8r-mw84-88v2. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket b","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-14T12:31:24Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 3.7.4"},{"id":"GHSA-p8cp-78hp-wmq8","title":"Duplicate Advisory: SQL injection in backlink\/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-q2vg-7qgx-x5fc. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink\/mention sear","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-14T12:31:24Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 3.7.4"},{"id":"GHSA-p28v-f755-9qrg","title":"Trigger.dev: Prototype pollution via run metadata operations \u2192 process-wide cross-tenant DoS","aliases":["CVE-2026-73654"],"summary":"## Summary\n\nThe run-metadata update endpoint `PUT \/api\/v1\/runs\/:runId\/metadata` applies client-supplied\n\"operations\" by passing the **attacker-controlled `operation.key`** straight into\n`new JSONHeroPath(operation.key).set(newMetadata, value)`\n(`packages\/core\/src\/v3\/runMetadata\/o","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@trigger.dev\/core","publishedAt":"2026-08-13T20:54:11Z","exploitedKev":false,"fixedVersion":"4.5.6","vulnerableRange":">= 3.3.8 <= 4.5.5"},{"id":"GHSA-m42h-3232-vpv3","title":"nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences","aliases":["CVE-2026-12243"],"summary":"# Summary\nnltk.data.load() and nltk.data.find() resolve user-supplied resource names to filesystem paths using url2pathname(), which decodes percent-encoded sequences (e.g. %2e%2e to ..). Path safety checks are performed on the raw, still-encoded string before decoding occurs. An","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-08-13T20:45:05Z","exploitedKev":false,"fixedVersion":"3.10.0","vulnerableRange":"< 3.10.0"},{"id":"GHSA-rm43-82j9-r4mj","title":"atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read","aliases":[],"summary":"The optional dashboard HTTP server (`atomic_agents\/dashboard\/serve.py`) builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through `_io.safe_resolve","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"atomic-agents-stack","publishedAt":"2026-08-13T14:17:13Z","exploitedKev":false,"fixedVersion":"1.1.0","vulnerableRange":"<= 1.0.0"},{"id":"GHSA-48p8-g2fx-3wwm","title":"Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict\/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)","aliases":["CVE-2026-54526"],"summary":"### Summary\n\nThe allow-list fix for CVE-2026-31892 (GHSA-3wf5-g532-rcrr), and its follow-up coverage of `hostNetwork`\/`securityContext`\/`serviceAccountName` in GHSA-3775-99mw-8rp4, is incomplete. `workflow\/util\/merge.go` `ValidateUserOverrides` \/ `SanitizeUserWorkflowSpec` walk o","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/argoproj\/argo-workflows\/v4","publishedAt":"2026-08-13T14:16:09Z","exploitedKev":false,"fixedVersion":"4.0.6","vulnerableRange":">= 4.0.0 < 4.0.6"},{"id":"GHSA-2mhj-fhvg-v428","title":"Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name","aliases":["CVE-2026-55072"],"summary":"### Summary\nA missing end anchor (`$`) in the ClassDefinition UID validation regex allows an authenticated user with the `objects` permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw cl","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"pimcore\/pimcore","publishedAt":"2026-08-13T13:44:24Z","exploitedKev":false,"fixedVersion":"2026.1.5","vulnerableRange":">= 2026.1.0 <= 2026.1.4"},{"id":"GHSA-75xh-mp4f-f2rf","title":"Duplicate Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-9cqf-hhrq-7v45. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 ","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-13T12:31:10Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.0.0-20260726161145-9b8e8956f997 < 0.0.0-20260812083335-251596fc0de2"},{"id":"GHSA-6j9g-8fxc-25hq","title":"Duplicate Advisory: Flowise contains an unauthenticated sandbox escape","aliases":[],"summary":"# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9gvv-qjj3-2p6g. This link is maintained to preserve external references.\n\n# Original Description\n\nFlowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escap","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-13T12:31:09Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-x3jw-7gj7-qv6m","title":"Duplicate Advisory: Flowise Prompt Injection to RCE and SSRF via CSV\/Airtable Agent Python Validator Bypass","aliases":[],"summary":"# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-w7x8-q2gp-5cgg. This link is maintained to preserve external references.\n\n# Original Description\n\nFlowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable A","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"flowise","publishedAt":"2026-08-13T12:31:09Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"< 3.1.3"},{"id":"GHSA-cxgv-hp74-jj7r","title":"Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)","aliases":["CVE-2026-55074"],"summary":"Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host (<jail filesystem root> + <destination>) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operate","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"ansible-jailexec","publishedAt":"2026-08-12T23:21:06Z","exploitedKev":false,"fixedVersion":"2.0.0","vulnerableRange":"< 2.0.0"},{"id":"GHSA-v598-7627-g9fx","title":"Duplicate Advisory: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-vpjw-wf5h-cgpq. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLoca","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-12T21:31:42Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.7.2"},{"id":"GHSA-8wx9-j7j5-h9vp","title":"Duplicate Advisory: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port prox","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-3mp7-4rh5-jrv9. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-12T21:31:42Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 3.7.4"},{"id":"GHSA-2jmx-q9jf-wp3w","title":"Duplicate Advisory: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-x67c-8pwr-m8g3. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribut","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-12T21:31:42Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 3.7.4"},{"id":"GHSA-hg4j-w33m-p7g4","title":"Duplicate Advisory: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by \/api\/system\/getConf","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-34fj-mwm6-fjfg. This link is maintained to preserve external references.\n\n## Original Description\nsiyuan versions before v3.7.4 expose the session cookie signing key through the \/api\/system\/","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-12T21:31:41Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.7.2"},{"id":"GHSA-2qqv-3jgq-vpm9","title":"Duplicate Advisory: Non-administrator responses from \/api\/system\/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-h4v5-crx2-3cv4. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the \/api\/system","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-12T21:31:41Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.7.3"},{"id":"GHSA-cjwm-9h7g-pcr9","title":"Duplicate Advisory: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-h6w7-xxcf-w2mq. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-12T21:31:41Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.7.2"},{"id":"GHSA-xx34-6cjg-prh8","title":"Duplicate Advisory: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-v684-q882-jgmq. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, trea","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-12T21:31:41Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 3.7.4"},{"id":"GHSA-mg8q-52j3-w5f8","title":"Duplicate Advisory: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-mfrj-v65r-979c. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttr","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-12T21:31:41Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.7.2"},{"id":"GHSA-hr3f-qfrh-h7w5","title":"Duplicate Advisory: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-8x84-r2ff-h8pq. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrappe","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-12T21:31:41Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.7.2"},{"id":"GHSA-49m4-vp58-wgc9","title":"MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`","aliases":["CVE-2026-55071"],"summary":"## Stata Command Injection via Unsanitized `package` in `ado_package_install`\n\n### Summary\n\nThe `ado_package_install` MCP tool in `stata-mcp` concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"stata-mcp","publishedAt":"2026-08-12T19:23:38Z","exploitedKev":false,"fixedVersion":"1.19.0","vulnerableRange":"< 1.19.0"},{"id":"GHSA-w62w-66v9-vvgv","title":"SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access","aliases":["CVE-2026-54917"],"summary":"## Summary\n\nThe S3 API gateway and the Iceberg REST catalog gateway construct their routers with `mux.NewRouter().SkipClean(true)`. With path cleaning disabled, a `..` segment inside the URL survives routing, so a request such as:\n\n```\nGET \/bucket-A\/..\/evil-bucket\/key\n```\n\nis mat","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/seaweedfs\/seaweedfs","publishedAt":"2026-08-12T19:19:54Z","exploitedKev":false,"fixedVersion":"0.0.0-20260526080459-dd1b4287899e","vulnerableRange":"< 0.0.0-20260526080459-dd1b4287899e"},{"id":"GHSA-q4c3-7575-55j2","title":"Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs","aliases":["CVE-2026-67260"],"summary":"Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author \u2014 who controls that value through the task execution","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"apache-airflow","publishedAt":"2026-08-12T18:31:18Z","exploitedKev":false,"fixedVersion":"3.3.1","vulnerableRange":">= 3.3.0 < 3.3.1"},{"id":"GHSA-2qjv-p2gc-mjg2","title":"Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler","aliases":["CVE-2026-67587"],"summary":"Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-li","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"apache-airflow","publishedAt":"2026-08-12T18:31:18Z","exploitedKev":false,"fixedVersion":"3.3.1","vulnerableRange":">= 3.3.0 < 3.3.1"},{"id":"GHSA-j4jc-cq9h-xrhr","title":"Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass","aliases":["CVE-2026-68968"],"summary":"Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"apache-airflow","publishedAt":"2026-08-12T18:31:18Z","exploitedKev":false,"fixedVersion":"3.3.1","vulnerableRange":"< 3.3.1"},{"id":"GHSA-8prw-8m6x-8w6f","title":"Apache Airflow exception-node deserialization permits arbitrary callable execution","aliases":["CVE-2026-58076"],"summary":"Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` re","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"apache-airflow","publishedAt":"2026-08-12T18:31:17Z","exploitedKev":false,"fixedVersion":"3.3.1","vulnerableRange":">= 3.3.0 < 3.3.1"},{"id":"GHSA-h47f-gmjp-m7rr","title":"compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0","aliases":["CVE-2026-52776"],"summary":"### Summary\n\n`compliance-trestle` 4.0.3 (latest) ships an `URLSecurityValidator` in `trestle\/core\/remote\/security.py` to block SSRF to loopback \/ link-local \/ cloud-metadata endpoints from the HTTPSFetcher and SFTPFetcher remote-fetch paths. The allowlist is incomplete and can be","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"compliance-trestle","publishedAt":"2026-08-12T15:21:17Z","exploitedKev":false,"fixedVersion":"4.1.0","vulnerableRange":"< 4.1.0"},{"id":"GHSA-3763-qp59-59vf","title":"nimiq-blockchain: Validity store off by one error","aliases":["CVE-2026-46369"],"summary":"### Impact\nThe validity store treats a transaction with stored `block_number = X` as \"in window\" only when `X > last_bn - transaction_validity_window_blocks` (strict inequality). However the protocol's `Transaction::is_valid_at` accepts a transaction for inclusion in any block in","severity":"high","sourceId":"github-advisories","ecosystem":"cargo","packageName":"nimiq-blockchain","publishedAt":"2026-08-12T15:16:53Z","exploitedKev":false,"fixedVersion":"1.5.1","vulnerableRange":"<= 1.5.0"},{"id":"GHSA-j5jq-cr68-v2xx","title":"Winter: Authenticated backend users can bypass Users controller permission checks","aliases":["CVE-2026-35445"],"summary":"### Impact\n\nAffected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism (`_handler` POST field) in the same way as AJAX requests (`X_WINTER_REQUEST_HANDLER` header). The AJAX path validates that handler names match the `on[A-Z][","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"winter\/wn-backend-module","publishedAt":"2026-08-12T15:15:17Z","exploitedKev":false,"fixedVersion":"1.2.13","vulnerableRange":"<= 1.2.12"},{"id":"GHSA-vgp4-2fc4-qff2","title":"Winter: Stored XSS through Editor Settings custom styles","aliases":["CVE-2026-32258"],"summary":"### Impact                                                                                                       \n                                                                                                                   \nAuthenticated Backend Users with the `backend.mana","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"winter\/wn-backend-module","publishedAt":"2026-08-12T14:40:38Z","exploitedKev":false,"fixedVersion":"1.2.13","vulnerableRange":">= 1.2.10 < 1.2.13"},{"id":"GHSA-v7cf-8gh9-gxmj","title":"Winter: Stored XSS through Brand Settings custom styles","aliases":["CVE-2026-32257"],"summary":"### Impact                                                                                                       \n\nUsers with the `backend.manage_branding` (\"Customize the back-end\") permission can provide custom CSS through **Settings \u2192 Customize Backend \u2192 Styles** that is compi","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"winter\/wn-backend-module","publishedAt":"2026-08-12T14:40:21Z","exploitedKev":false,"fixedVersion":"1.2.13","vulnerableRange":"<= 1.2.12"},{"id":"GHSA-87fv-vqqr-m4jr","title":"SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle","aliases":["CVE-2026-73080"],"summary":"### Impact\n`VolumeServer.FetchAndWriteNeedle` fetches a caller-supplied remote endpoint and writes the response into a needle. Before 4.24 this RPC performed no authentication and no validation of the target, so anyone able to reach a volume server's gRPC port could coerce the se","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/seaweedfs\/seaweedfs","publishedAt":"2026-08-11T15:58:23Z","exploitedKev":false,"fixedVersion":"0.0.0-20260512171120-69da20bdaec9","vulnerableRange":"< 0.0.0-20260512171120-69da20bdaec9"},{"id":"GHSA-4hc4-qjfx-wjf3","title":"Duplicate Advisory: Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures\/move-element","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-xxpx-f366-4xpq. This link is maintained to preserve external references.\n\n## Original Description\nCraft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A cont","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"craftcms\/cms","publishedAt":"2026-08-11T15:32:39Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 5.0.0-RC1 < 5.10.6"},{"id":"GHSA-h784-hpjp-2rrm","title":"Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-f5wm-88jv-g5hx. This link is maintained to preserve external references.\n\n## Original Description\nCraft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remot","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"craftcms\/cms","publishedAt":"2026-08-11T15:32:39Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 4.0.0-RC1 < 4.18.3"},{"id":"GHSA-cc2g-26rw-g997","title":"Duplicate Advisory: Craft CMS: Authenticated leak of secret environment variables","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-596p-6jv8-775v. This link is maintained to preserve external references.\n\n## Original Description\nCraft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate env","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"craftcms\/cms","publishedAt":"2026-08-11T15:32:39Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 4.0.0-RC1 < 4.18.2"},{"id":"GHSA-2p2v-3mjg-gfpf","title":"Duplicate Advisory: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-957r-qf9p-67xw. This link is maintained to preserve external references.\n\n## Original Description\nCraft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"craftcms\/cms","publishedAt":"2026-08-11T15:32:38Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 4.0.0-RC1 < 4.18.2"},{"id":"GHSA-w36c-qxrq-v7fw","title":"Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-265m-7826-wjqm. This link is maintained to preserve external references.\n\n## Original Description\nCraft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"craftcms\/cms","publishedAt":"2026-08-11T15:32:38Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 4.0.0-RC1 < 4.18.2"},{"id":"GHSA-4f2f-jr2m-j7p4","title":"Duplicate Advisory: TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-68jx-f42c-7599. This link is maintained to preserve external references.\n\n## Original Description\nThe referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became inef","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"typo3\/cms-core","publishedAt":"2026-08-11T09:32:33Z","exploitedKev":false,"fixedVersion":"13.4.34","vulnerableRange":">= 13.0.0 < 13.4.34"},{"id":"GHSA-vhh6-v828-x62f","title":"SAP Approuter has an Information Disclosure vulnerability","aliases":["CVE-2026-58230"],"summary":"SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is hig","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@sap\/approuter","publishedAt":"2026-08-11T03:31:56Z","exploitedKev":false,"fixedVersion":"23.0.0","vulnerableRange":"< 23.0.0"},{"id":"GHSA-rg76-677x-56q9","title":"crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain","aliases":["CVE-2026-71851"],"summary":"### Summary\n\n`CryptoJS.lib.WordArray.random()` in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities \u2014 small enough to enumerate ","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"crypto-js","publishedAt":"2026-08-07T18:48:59Z","exploitedKev":false,"fixedVersion":"4.0.0","vulnerableRange":"< 4.0.0"},{"id":"GHSA-gm37-52c6-37mw","title":"pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors","aliases":["CVE-2026-67422"],"summary":"### Summary\n\nFour inline processors in pymdown-extensions contain regular expressions with\nexponential backtracking. A single untrusted Markdown line under\n50 bytes drives `markdown.markdown()` into unbounded CPU on the rendering thread\n(seconds at ~45 bytes, growing exponentiall","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"pymdown-extensions","publishedAt":"2026-08-07T18:26:07Z","exploitedKev":false,"fixedVersion":"11.0.1","vulnerableRange":"<= 11.0.0"},{"id":"GHSA-mmj4-63m4-r6h5","title":"CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules","aliases":["CVE-2026-63223"],"summary":"### Impact\nThis is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations.\n\nApplications are impacted when they:\n- validate uploads using `is_image` or `mime_in` without an independent safe extension check, s","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"codeigniter4\/framework","publishedAt":"2026-08-07T18:24:21Z","exploitedKev":false,"fixedVersion":"4.7.4","vulnerableRange":"< 4.7.4"},{"id":"GHSA-hhmc-q9hp-r662","title":"CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames","aliases":["CVE-2026-63222"],"summary":"### Impact\nIn affected versions, calling `UploadedFile::move()` **without a second argument** uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"codeigniter4\/framework","publishedAt":"2026-08-07T18:23:46Z","exploitedKev":false,"fixedVersion":"4.7.4","vulnerableRange":"< 4.7.4"},{"id":"GHSA-c9w5-rwh3-7pm9","title":"CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions","aliases":["CVE-2026-63221"],"summary":"### Impact\nA SQL injection vulnerability exists in the Query Builder's `deleteBatch()` method. When `deleteBatch()` is used together with `where()` conditions, the bound values from the `WHERE` clause are substituted directly into the generated SQL **with their escape flag ignore","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"codeigniter4\/framework","publishedAt":"2026-08-07T18:22:59Z","exploitedKev":false,"fixedVersion":"4.7.4","vulnerableRange":">= 4.3.0 < 4.7.4"},{"id":"GHSA-wcx4-wpfv-mc5c","title":"jsii-diff: Command Injection via npm: package argument","aliases":["CVE-2026-15895"],"summary":"## Summary\n\njsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell command","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"jsii-diff","publishedAt":"2026-08-07T18:15:47Z","exploitedKev":false,"fixedVersion":"1.131.0","vulnerableRange":"< 1.131.0"},{"id":"GHSA-hc8v-wwc9-vgxm","title":"go-git: Worktree operations may follow symlinks","aliases":["CVE-2026-71556"],"summary":"## Impact\n\nA symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path.\n\nThe `worktreeFilesystem` wrapper rejected dangerous path strings, including paths containing `.git`, parent-directory components, or control chara","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/go-git\/go-git\/v5","publishedAt":"2026-08-07T16:38:15Z","exploitedKev":false,"fixedVersion":"5.19.2","vulnerableRange":"<= 5.19.1"},{"id":"GHSA-wvpp-8hx9-p66j","title":"GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution","aliases":["CVE-2026-76220"],"summary":"## Summary\nThe `check_unsafe_options` guard can be bypassed on every guarded method (clone\/clone_from, fetch\/pull\/push, ls_remote, iter_commits, blame, archive) by combining a single-character kwarg with `split_single_char_options=False`. The guard's candidate list omits the smug","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-08-07T15:49:07Z","exploitedKev":false,"fixedVersion":"3.1.58","vulnerableRange":"<= 3.1.57"},{"id":"GHSA-jm78-9fvv-mhgr","title":"GitPython: git-config OPTION-name injection via =\/#\/whitespace bypasses name validator, enabling forged core.sshCommand\/hooksPath (RCE)","aliases":[],"summary":"## Summary\nGitPython's config-name validator only neutralizes CR\/LF\/NUL for the `\"option\"` label; it does not reject `=`, `#`, `;`, `[`, `]`, or whitespace in an **option name**. `write_section` writes the option name verbatim into the config file, so an option name such as `sshC","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-08-07T15:46:35Z","exploitedKev":false,"fixedVersion":"3.1.58","vulnerableRange":"<= 3.1.57"},{"id":"GHSA-hmq2-w58f-27jc","title":"GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython","aliases":["CVE-2026-76222"],"summary":"### Summary\nGitPython computes the on-disk location of a submodule's separate Git directory (`.git\/modules\/<name>`) from the submodule's `.gitmodules` section name with no validation. Because that name is fully attacker-controlled content of a cloned repository, a malicious repos","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-08-07T15:45:39Z","exploitedKev":false,"fixedVersion":"3.1.58","vulnerableRange":"<= 3.1.57"},{"id":"GHSA-9rj7-rf2p-w77r","title":"GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks","aliases":["CVE-2026-76218"],"summary":"## Summary\n`Repo.init()` forwards `**kwargs` verbatim to `git init` with no unsafe-option guard and no `allow_unsafe_options` parameter. `git init --template=<dir>` copies `<dir>\/hooks\/*` into the new repo's `.git\/hooks`, so an attacker-controlled `template` kwarg plants a hook t","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-08-07T15:36:43Z","exploitedKev":false,"fixedVersion":"3.1.58","vulnerableRange":"<= 3.1.57"},{"id":"GHSA-4gmw-gg2m-w46p","title":"GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree\/reset\/merge_tree enables arbitrary file overwrite","aliases":["CVE-2026-76219"],"summary":"## Summary\n`IndexFile.from_tree`, `IndexFile.reset` (\u2192 from_tree) and `IndexFile.merge_tree` append caller-influenced treeish strings positionally to `git read-tree` with no unsafe-option guard, no `allow_unsafe_options` parameter, and no `--` separator. `git read-tree --index-ou","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-08-07T15:33:57Z","exploitedKev":false,"fixedVersion":"3.1.58","vulnerableRange":"<= 3.1.57"},{"id":"GHSA-wg23-69c2-gjc8","title":"Craft CMS: Passkey login accepts replayed WebAuthn assertions","aliases":[],"summary":"Craft CMS passkey login accepts WebAuthn requestOptions from the unauthenticated login request body and does not persist the updated credential counter returned by the WebAuthn assertion validator. A captured passkey login request body can therefore be replayed because the old ch","severity":"critical","sourceId":"github-advisories","ecosystem":"composer","packageName":"craftcms\/cms","publishedAt":"2026-08-07T14:57:29Z","exploitedKev":false,"fixedVersion":"5.10.5","vulnerableRange":">= 5.0.0-RC1 < 5.10.5"},{"id":"GHSA-hmqg-cxww-wqhq","title":"PHP_CodeSniffer gitblame report command injection via crafted filename","aliases":["CVE-2026-67434"],"summary":"### Impact\n\nPHP_CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the `Gitblame`, `Hgblame` and `Svnblame` report(s).\n\nAs a result, running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans p","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"squizlabs\/php_codesniffer","publishedAt":"2026-08-06T21:31:34Z","exploitedKev":false,"fixedVersion":"3.13.6","vulnerableRange":"< 3.13.6"},{"id":"GHSA-w9hm-4m3m-fxmm","title":"ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633","aliases":[],"summary":"ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json.\n\n### Impact\nOpening a malicious PDF can execute attacker-controlled JavaScript in the context of the ho","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ngx-extended-pdf-viewer","publishedAt":"2026-08-06T21:13:59Z","exploitedKev":false,"fixedVersion":"29.0.0-rc.3","vulnerableRange":">= 27.0.0-rc.0 < 29.0.0-rc.3"},{"id":"GHSA-hq66-cqwq-w95j","title":"PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF ","aliases":["CVE-2026-16633"],"summary":"### Impact\n\nIf PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"pdfjs-dist","publishedAt":"2026-08-06T21:12:27Z","exploitedKev":false,"fixedVersion":"6.2.108","vulnerableRange":">= 5.6.83 < 6.2.108"},{"id":"GHSA-p8x7-9vfw-p7vc","title":"Craft CMS: Arbitrary user password reset leading to administrator account takeover","aliases":[],"summary":"The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has `edit users` permission (which does","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"craftcms\/cms","publishedAt":"2026-08-06T21:04:11Z","exploitedKev":false,"fixedVersion":"5.10.8","vulnerableRange":">= 5.0.0-RC1 < 5.10.8"},{"id":"GHSA-f5wm-88jv-g5hx","title":"Craft CMS: Authenticated RCE through Twig sandbox escape","aliases":["CVE-2026-72781"],"summary":"The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE in a manner similar to previously disclosed vulnerabilities.\n\nThe Twig sandbox in Craft CMS works by implementing Twig's `SecurityPolicyInte","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"craftcms\/cms","publishedAt":"2026-08-06T21:02:28Z","exploitedKev":false,"fixedVersion":"5.10.7","vulnerableRange":">= 5.0.0-RC1 < 5.10.7"},{"id":"GHSA-265m-7826-wjqm","title":"Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass","aliases":["CVE-2026-72778"],"summary":"Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling.\n\nCraft cleans the outer request-controlled condition array with `Component::cleanseConfig()`, but `Conditions::createCondition()` later decodes and merges the JSON s","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"craftcms\/cms","publishedAt":"2026-08-06T20:45:00Z","exploitedKev":false,"fixedVersion":"5.10.6","vulnerableRange":">= 5.0.0-RC1 < 5.10.6"},{"id":"GHSA-mh25-x5hq-wrqp","title":"league\/commonmark: Denial of service via colliding heading slugs","aliases":[],"summary":"### Impact\n\n`UniqueSlugNormalizer::normalize()` makes each slug document-unique by searching for an unused numeric suffix, but **restarts that search from `1` on every collision**. The k-th heading that collapses to the same base slug performs k\u22121 array lookups, so K colliding sl","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"league\/commonmark","publishedAt":"2026-08-06T20:41:45Z","exploitedKev":false,"fixedVersion":"2.9.0","vulnerableRange":">= 2.0.0 < 2.9.0"},{"id":"GHSA-jfm3-95jq-q3rf","title":"league\/commonmark:  Denial of service via duplicate footnote definitions","aliases":[],"summary":"### Impact\n\nThe Footnote extension records one backref per footnote *reference* and then appends the **entire** backref list for **every** footnote *definition* block in the document, without ever de-duplicating or removing repeated definitions of the same label (`GatherFootnotes","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"league\/commonmark","publishedAt":"2026-08-06T20:40:53Z","exploitedKev":false,"fixedVersion":"2.9.0","vulnerableRange":">= 1.5.0 < 2.9.0"},{"id":"GHSA-g2gp-3wwq-f4ph","title":"league\/commonmark: Denial of service via adjacent inline attribute blocks","aliases":[],"summary":"### Impact\n\nWith the Attributes extension enabled, `AttributesListener::findTargetAndDirection()` resolves each attribute node's target by walking outward through its siblings. For a run of N adjacent inline attribute blocks placed at the start of a block (with nothing to their l","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"league\/commonmark","publishedAt":"2026-08-06T20:39:52Z","exploitedKev":false,"fixedVersion":"2.9.0","vulnerableRange":">= 1.5.0 < 2.9.0"},{"id":"GHSA-2q4p-g7hv-5rgv","title":"league\/commonmark: Quadratic-time denial of service when parsing crafted Markdown","aliases":["CVE-2026-71488"],"summary":"### Impact\n\nAffected versions of `league\/commonmark` can have quadratic time complexity when parsing specially crafted Markdown lines. In practical terms, doubling the length of an affected line can make the parser perform roughly four times as much work. The parser identifies lo","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"league\/commonmark","publishedAt":"2026-08-06T20:37:20Z","exploitedKev":false,"fixedVersion":"2.9.0","vulnerableRange":">= 0.6.0 < 2.9.0"},{"id":"GHSA-5p4m-2wfm-xmqj","title":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported","aliases":[],"summary":"# Quadratic CPU consumption in `!!omap` resolution (js-yaml 3.x and 4.x)\n\n## Summary\n\n`resolveYamlOmap()` enforces key uniqueness for `!!omap` sequences with a linear\nscan (`objectKeys.indexOf(...)`) inside the per-element loop, making resolution\n**O(n\u00b2)** in the number of entrie","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"js-yaml","publishedAt":"2026-08-06T20:27:32Z","exploitedKev":false,"fixedVersion":"4.3.1","vulnerableRange":">= 4.0.0 < 4.3.1"},{"id":"GHSA-vp3h-ghgh-jr7g","title":"Nx: Zip-Slip in the self-hosted remote cache","aliases":["CVE-2026-71476"],"summary":"## Summary\n\nThe Nx **self-hosted HTTP remote cache** extracts downloaded cache artifacts without constraining where files are written. A malicious \u2014 or on-path (MITM) \u2014 remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbi","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nx","publishedAt":"2026-08-06T20:10:03Z","exploitedKev":false,"fixedVersion":"22.7.7","vulnerableRange":">= 20.8.0 < 22.7.7"},{"id":"GHSA-93qh-5269-9wcf","title":"Statamic: Account takeover via OAuth email matching without email-verification check","aliases":["CVE-2026-64665"],"summary":"### Impact\n\nWhen OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user \u2014 potentially including a super admin \u2014 without their password. Exploitation requires OAuth to be explicitly ena","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"statamic\/cms","publishedAt":"2026-08-06T19:25:05Z","exploitedKev":false,"fixedVersion":"5.74.1","vulnerableRange":"< 5.74.1"},{"id":"GHSA-x677-9fxg-v5c5","title":"Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth \/ DigestAuth \/ ForwardAuth","aliases":["CVE-2026-54763"],"summary":"## Summary\n\nThere is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth\nmiddlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers\n(e.g. `X-Auth-User`) before writing Traefik's own value, but did not account for\nunders","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/traefik\/traefik\/v2","publishedAt":"2026-08-06T16:53:53Z","exploitedKev":false,"fixedVersion":"2.11.51","vulnerableRange":"<= 2.11.50"},{"id":"GHSA-cxjq-mrr5-89rv","title":"Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware","aliases":["CVE-2026-65600"],"summary":"## Summary\n\nThere is a critical authentication-bypass vulnerability in Traefik's `ReplacePathRegex` middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator (for example `regex: \"^\/api(.*)\"`, `replacemen","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/traefik\/traefik\/v2","publishedAt":"2026-08-06T16:51:10Z","exploitedKev":false,"fixedVersion":"2.11.52","vulnerableRange":"<= 2.11.51"},{"id":"GHSA-8rxv-jg7p-wvg3","title":"Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass","aliases":["CVE-2026-67309"],"summary":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the `nginx.ingress.kubernetes.io\/rewrite-target` annotation with a regular expression that captures attacker-controlled text without requiring a path separator ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/traefik\/traefik\/v3","publishedAt":"2026-08-06T16:45:28Z","exploitedKev":false,"fixedVersion":"3.7.8","vulnerableRange":">= 3.7.0 <= 3.7.7"},{"id":"GHSA-fgjj-px3w-67xx","title":"Traefik: Gateway API route identity collision allows cross-namespace backend hijacking","aliases":["CVE-2026-71327"],"summary":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Gateway API provider. Router and service identities for `HTTPRoute`, `GRPCRoute`, `TCPRoute` and `TLSRoute` objects were built by hyphen-concatenating the route namespace, the route name, the Gateway ident","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/traefik\/traefik\/v3","publishedAt":"2026-08-06T16:38:18Z","exploitedKev":false,"fixedVersion":"3.6.25","vulnerableRange":">= 3.0.0 < 3.6.25"},{"id":"GHSA-3ccp-42pg-hgv6","title":"Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool","aliases":["CVE-2026-71324"],"summary":"## Summary\n\nThere is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP\/2 or HTTP\/3 `CONNECT` request, Traefik forwards it \u2014 body included \u2014 to an HTTP\/1.1 upstream over a share","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/traefik\/traefik\/v2","publishedAt":"2026-08-06T15:56:40Z","exploitedKev":false,"fixedVersion":"2.11.53","vulnerableRange":"<= 2.11.52"},{"id":"GHSA-9pgf-384g-p7mv","title":"Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation","aliases":["CVE-2026-71321"],"summary":"### Impact\n\nThe internal island renderer endpoint (`\/__nuxt_island\/...`) decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated `POST \/__nuxt_island\/<name>_<anything>.json` with a large JSON body (for example ~4.6 MB \/ 1","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nuxt","publishedAt":"2026-08-05T21:43:03Z","exploitedKev":false,"fixedVersion":"4.5.1","vulnerableRange":">= 4.0.0 < 4.5.1"},{"id":"GHSA-9pw3-x84f-xcwf","title":"Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-jxw3-mjmx-3pqm. This link is maintained to preserve external references.\n\n## Original Description\nIBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the\u00a0ensure_fe","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"langflow","publishedAt":"2026-08-05T21:31:38Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 1.10.0"},{"id":"GHSA-9473-5f9j-94wq","title":"Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props","aliases":["CVE-2026-71320"],"summary":"## Impact\n\nNuxt server islands accept props via the `\/__nuxt_island\/` endpoint. When `vue.runtimeCompiler: true` is enabled (off by default) and the application has a server island component that forwards props into Vue's dynamic component resolution (`<component :is>`, `resolveD","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nuxt","publishedAt":"2026-08-05T21:29:55Z","exploitedKev":false,"fixedVersion":"4.5.1","vulnerableRange":">= 4.0.0 < 4.5.1"},{"id":"GHSA-279x-mwfv-vcqv","title":"Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host","aliases":["CVE-2026-71319"],"summary":"### Impact\n\nNuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the `nuxt:devtools:rpc` plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (`ws:\/\/<host>:<port>\/`, su","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@nuxt\/devtools","publishedAt":"2026-08-05T21:27:39Z","exploitedKev":false,"fixedVersion":"3.3.1","vulnerableRange":"< 3.3.1"},{"id":"GHSA-wm8w-6qjm-cv43","title":"Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients","aliases":["CVE-2026-71316"],"summary":"### Impact\n\nWhen a page is covered by `routeRules` `cache` \/ `swr` \/ `isr`, Nuxt enables runtime payload extraction and serves `\/<page>\/_payload.json`. On affected versions the renderer stored the SSR payload in the shared `cache:nuxt:payload` storage under a path-only key (no co","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nuxt","publishedAt":"2026-08-05T21:14:33Z","exploitedKev":false,"fixedVersion":"4.5.1","vulnerableRange":">= 4.4.0 <= 4.5.0"},{"id":"GHSA-hxvh-4h3w-prp9","title":"Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)","aliases":["CVE-2026-71315"],"summary":"### Impact\n\nNuxt matches route rules case-insensitively by default (mirroring vue-router's default `sensitive: false` routing). The fix for GHSA-mm7m-92g8-7m47 \/ CVE-2026-53721 lowercased the *lookup* path before matching route rules, but the route-rule *keys* compiled into the m","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nuxt","publishedAt":"2026-08-05T21:05:18Z","exploitedKev":false,"fixedVersion":"4.5.1","vulnerableRange":">= 4.4.7 < 4.5.1"},{"id":"GHSA-hxcr-hm88-mpq6","title":"Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering","aliases":["CVE-2026-71314"],"summary":"### Impact\n\nAn unauthenticated attacker can crash a Nuxt server that renders any island \/ server component containing a `v-for` over a prop (for example `v-for=\"n in count\"` or a `<slot v-for>`). Because the island URL hash is a non-secret digest of the request, the attacker can ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"nuxt","publishedAt":"2026-08-05T20:59:04Z","exploitedKev":false,"fixedVersion":"4.5.1","vulnerableRange":">= 4.0.0 < 4.5.1"},{"id":"GHSA-fqj9-69pf-6pjg","title":"rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories","aliases":["CVE-2026-59733"],"summary":"## Summary\n\n`rclone serve restic --private-repos` exists to let one rclone instance host many users' restic backup repositories behind HTTP Basic auth while keeping each user confined to a path prefix of `\/<username>\/`. The documentation states the flag \"can be used to limit user","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rclone\/rclone","publishedAt":"2026-08-05T20:41:22Z","exploitedKev":false,"fixedVersion":"1.74.4","vulnerableRange":"<= 1.74.3"},{"id":"GHSA-2m8m-jhrm-w6j2","title":"rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution","aliases":["CVE-2026-71312"],"summary":"## 1. Summary\n\nrclone interpolates remote SFTP paths into PowerShell hash commands. Its quoting helper escapes only ASCII apostrophe, although PowerShell accepts four Unicode smart quotes as single-quote delimiters. An attacker-controlled filename can therefore terminate the inte","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rclone\/rclone","publishedAt":"2026-08-05T20:37:56Z","exploitedKev":false,"fixedVersion":"1.75.0","vulnerableRange":"<= 1.74.4"},{"id":"GHSA-cf44-9pgv-m4xc","title":"rclone: Unvalidated symlink target in local `--links` \u2014 arbitrary file write from an untrusted remote","aliases":["CVE-2026-54572"],"summary":"### Summary\nWith `-l\/--links`, rclone serializes symlinks as `<name>.rclonelink` text objects whose body is the link target. When rclone writes such an object to a local destination, it recreates the symlink with `os.Symlink(<object body>, <dest path>)` and performs NO validation","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rclone\/rclone","publishedAt":"2026-08-05T20:15:01Z","exploitedKev":false,"fixedVersion":"1.74.4","vulnerableRange":"<= 1.74.3"},{"id":"GHSA-45pq-889g-fcgh","title":"rclone: Incomplete path validation allows backend root escape in serve restic","aliases":["CVE-2026-71309"],"summary":"## Summary\n\n`rclone serve restic` does not correctly reject URL paths beginning with `..\/`. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator.\n\nThe issue affects `rclone v1","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/rclone\/rclone","publishedAt":"2026-08-05T20:13:36Z","exploitedKev":false,"fixedVersion":"1.75.0","vulnerableRange":">= 1.40.0 < 1.75.0"},{"id":"GHSA-9f4c-93c8-jc8g","title":"Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path","aliases":["CVE-2026-70608"],"summary":"### Impact\nA sandboxed iframe without the `allow-popups` keyword could still open a new window (or trigger `setWindowOpenHandler`) with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction.\n\nApps that embed","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"electron","publishedAt":"2026-08-05T17:27:18Z","exploitedKev":false,"fixedVersion":"42.0.1","vulnerableRange":">= 42.0.0-alpha.1 < 42.0.1"},{"id":"GHSA-v3j7-r9gq-3gjw","title":"Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads","aliases":["CVE-2026-70604"],"summary":"### Impact\nA custom scheme registered with `supportFetchAPI: true` but without `corsEnabled: true` was not subject to CORS enforcement. A page loaded from a remote origin could therefore `fetch()` or `XMLHttpRequest` that scheme cross-origin and read the full response body, rathe","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"electron","publishedAt":"2026-08-05T15:59:45Z","exploitedKev":false,"fixedVersion":"42.0.0","vulnerableRange":">= 42.0.0-alpha.1 < 42.0.0"},{"id":"GHSA-h7rp-cf8h-j98x","title":"Electron: Context isolation bypass via Function.prototype.bind hijack","aliases":["CVE-2026-70601"],"summary":"### Impact\nApps that expose Promise-returning functions to web content via `contextBridge` may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In rendere","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"electron","publishedAt":"2026-08-05T15:46:08Z","exploitedKev":false,"fixedVersion":"39.8.9","vulnerableRange":"< 39.8.9"},{"id":"GHSA-h7x2-h6g9-p789","title":" MLflow AI Gateway permits SSRF through an unvalidated api_base","aliases":["CVE-2026-71211"],"summary":"MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow\/server\/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow\/server\/gateway_api.py, ra","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"mlflow","publishedAt":"2026-08-05T09:31:18Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.13.0 <= 3.15.2"},{"id":"GHSA-xpp7-93x6-v29m","title":"XSS in Ghost's ActivityPub client","aliases":["CVE-2026-53950"],"summary":"### Impact\n\nThe ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server.\n\n### Vulnerable Versions\n\nThis vulnerability is present in the @tryghost\/activitypub package up to v3.0.8. All prior versions are als","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@tryghost\/activitypub","publishedAt":"2026-08-04T21:54:01Z","exploitedKev":false,"fixedVersion":"3.1.0","vulnerableRange":"< 3.1.0"},{"id":"GHSA-3cg5-48j3-v4gv","title":"Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder","aliases":["CVE-2026-70494"],"summary":"## Summary\nA user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on s","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"open-webui","publishedAt":"2026-08-04T20:58:12Z","exploitedKev":false,"fixedVersion":"0.11.0","vulnerableRange":">= 0.10.0 < 0.11.0"},{"id":"GHSA-pwxh-7358-jq2x","title":"Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages","aliases":["CVE-2026-70492"],"summary":"## Summary\nAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"open-webui","publishedAt":"2026-08-04T20:54:17Z","exploitedKev":false,"fixedVersion":"0.11.0","vulnerableRange":">= 0.10.0 < 0.11.0"},{"id":"GHSA-3xpf-xq7r-v8c5","title":"Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin","aliases":["CVE-2026-70486"],"summary":"## Summary\nAny authenticated user with access to a terminal server could get script of their choosing to run in the Open WebUI origin itself. The HTML file preview rendered terminal-served files in an iframe whose sandbox always granted `allow-same-origin` alongside `allow-script","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"open-webui","publishedAt":"2026-08-04T20:02:03Z","exploitedKev":false,"fixedVersion":"0.11.0","vulnerableRange":">= 0.9.0 <= 0.10.2"},{"id":"GHSA-8x5v-cpv7-8jjp","title":"Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs","aliases":["CVE-2026-70485"],"summary":"## Summary\n\nOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the litera","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"open-webui","publishedAt":"2026-08-04T19:59:36Z","exploitedKev":false,"fixedVersion":"0.11.0","vulnerableRange":">= 0.9.0 < 0.11.0"},{"id":"GHSA-rq84-p6rr-vf89","title":"Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client","aliases":["CVE-2026-70482"],"summary":"## Summary\n\nThe OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audienc","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"open-webui","publishedAt":"2026-08-04T19:52:01Z","exploitedKev":false,"fixedVersion":"0.11.0","vulnerableRange":">= 0.8.0 < 0.11.0"},{"id":"GHSA-w2rx-84hp-gg95","title":"Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader","aliases":["CVE-2026-70479"],"summary":"## Summary\nWith the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"open-webui","publishedAt":"2026-08-04T19:40:48Z","exploitedKev":false,"fixedVersion":"0.11.0","vulnerableRange":">= 0.9.6 < 0.11.0"},{"id":"GHSA-qgvm-j2hm-6m38","title":"Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens \u2014 enables token theft for any connected service","aliases":["CVE-2026-70478"],"summary":"### Summary\n\nThe OAuth2 token refresh endpoint (`POST \/api\/v1\/oauth2-credential\/refresh\/:credentialId`) is in `WHITELIST_URLS`, meaning it requires **no authentication**. It decrypts the stored credential (containing `clientId`, `clientSecret`, `refresh_token`), sends a refresh r","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T19:37:36Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-5xvg-pmgg-3mxr","title":"Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability","aliases":["CVE-2026-70477"],"summary":"-- ABSTRACT -------------------------------------\n\nTrend Micro's Zero Day Initiative has identified a vulnerability affecting the following products:\nFlowise - Flowise\n\n-- VULNERABILITY DETAILS ------------------------\n* Version tested: 3.1.1\n* Installer file: https:\/\/github.com\/","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T19:29:26Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-gmmw-qg98-6j6p","title":"Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation","aliases":["CVE-2026-70476"],"summary":"### Summary\nSeveral organization billing endpoints accept attacker-controlled Stripe identifiers (subscriptionId) without verifying that the identifier belongs to the authenticated user's organization. This allows an authenticated attacker to perform unauthorized Stripe subscript","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T19:24:07Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-fm2f-4339-4p2f","title":"Flowise: Missing Authorization on Execution Update Endpoint","aliases":["CVE-2026-70475"],"summary":"# Flowise Security Audit Report\n**Date**: 2026-03-17\n**Researcher**: Dimpal Jadhav (jadhavdimpy@gmail.com)\n**GitHub**: https:\/\/github.com\/Dimpyj1604\n**Target**: FlowiseAI\/Flowise (latest main branch)\n**Version**: flowise-components@3.1.0\n\n### FINDING 1: Missing Authorization on E","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T19:18:47Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-wvqv-fj8w-qmhm","title":"Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing","aliases":["CVE-2026-15307"],"summary":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `Geom","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"Django","publishedAt":"2026-08-04T18:31:27Z","exploitedKev":false,"fixedVersion":"5.2.17","vulnerableRange":"< 5.2.17"},{"id":"GHSA-wch5-xp77-fxg4","title":"Flowise: Cross-Workspace OAuth2 Credential Metadata Leak","aliases":["CVE-2026-70474"],"summary":"## Summary\n\nThree OAuth2 credential endpoints look up credentials by `id` alone with no `workspaceId` filter. Two of these endpoints (`callback`, `refresh`) are whitelisted from all authentication. This allows:\n\n1. **Cross-workspace credential access** \u2014 Any authenticated user ca","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T18:01:29Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-fr6g-7cq8-fg82","title":"Flowise: Information Disclosure in GET \/api\/v1\/upsert-history returns the entire server-wide upsert history","aliases":["CVE-2026-70473"],"summary":"### Summary\nThe **GET `\/api\/v1\/upsert-history`** endpoint returns the **entire server-wide upsert history** (response size **>100MB**) instead of being scoped to the requesting user\/tenant\/workspace. The response includes **sensitive configuration data** (e.g., Vector Store setti","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T17:57:27Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-chm3-vqcf-52rx","title":"Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store","aliases":["CVE-2026-70472"],"summary":"# Summary \n\nThese endpoints accept a client-controlled `credential` parameter. The server loads credentials by `id` and uses them directly, without checking whether that credential belongs to the caller\u2019s workspace. If an attacker knows another workspace\u2019s `credentialId`, they ca","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T17:51:48Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-4j8x-x6v7-w9rq","title":"Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation","aliases":["CVE-2026-69264"],"summary":"### Summary\nFlowise's `CSVAgent` interpolates an attacker-controlled segment of the\n`csvFile` data URI directly into a Python source-code template that is then\nexecuted by Pyodide. Because Pyodide is loaded with the default `js` bridge\nto `globalThis` (which on Node.js exposes `e","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T17:43:48Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-88pr-878c-24wf","title":"Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys                                                                                                  ","aliases":[],"summary":"## Summary                                                                                                                                                                                                   \n                                          \n  Flowise on current `main` all","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise-components","publishedAt":"2026-08-04T17:43:45Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-8r8h-6vcc-xhrv","title":"Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure","aliases":["CVE-2026-70471"],"summary":"## Finding \u2014 Unauthorized Workspace Variables disclosure via $vars injection (bypasses variables:view)\n\n  ### What\u2019s wrong (code locations)\n\n  - Variables for the active workspace are fetched without checking \u201cvariables:view\u201d at this call site: flowise-src\/\n    packages\/component","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T17:43:36Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-52fh-8v99-63c2","title":"Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE","aliases":["CVE-2026-70470"],"summary":"### Summary\nThe validatePythonCodeForDataFrame blacklist in packages\/components\/src\/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js mod","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T17:31:09Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-xc48-889x-5qmw","title":"Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)","aliases":["CVE-2026-69263"],"summary":"## Summary\n\nThe mitigation shipped for CVE-2025-8943 blocks the `-y` and `--yes` flags on `npx` to stop auto-installation of arbitrary packages. That flag filter works. The environment-variable check in the same patch denies only four variable names by exact string match, and `np","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T17:09:48Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-p5w8-m249-4r4v","title":"Flowise: `DELETE \/api\/v1\/chatflows\/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other\u2019s flow type","aliases":["CVE-2026-69262"],"summary":"# summary:\nIn Flowise, `DELETE \/api\/v1\/chatflows\/:id` authorizes requests with `checkAnyPermission('chatflows:delete,agentflows:delete')`. Possession of either permission is sufficient to reach the delete path. The delete logic does not validate the target resource `type`, allowi","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T16:50:32Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-x3hf-7cj6-3r4m","title":"Flowise RCE via SQLite Record Manager Node","aliases":["CVE-2026-69259"],"summary":"=============================================================================\n                                                            Security Advisory\n                                                                       elttam\n\nTopic:          Flowise RCE via SQLite Record","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T16:05:10Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-6vh2-wg4h-4vwj","title":"Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API","aliases":["CVE-2026-69258"],"summary":"#### Summary\n\nThe `POST \/api\/v1\/prediction\/:id` endpoint \u2014 which is unauthenticated (whitelisted in `WHITELIST_URLS`) \u2014 accepts an `overrideConfig` object in the request body. This object is unconditionally spread into the internal `flowConfig` and `flowData` objects at two locat","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T15:56:11Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-c6xh-wv4j-ppv5","title":"Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses","aliases":["CVE-2026-69257"],"summary":"## Summary\n\nFlowise's HTTP security module (`httpSecurity.ts`) fails to normalize IPv4-mapped IPv6 addresses (e.g., `::ffff:127.0.0.1`, `::ffff:169.254.169.254`) before checking them against the deny list. Due to an `ipaddr.js` kind mismatch (`ipv6` vs `ipv4`), all IPv4 CIDR deny","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T15:51:58Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-x6vm-w76m-8j7g","title":"Flowise: Remote Code Execution Vulnerability in CSVAgent","aliases":["CVE-2026-69256"],"summary":"### Summary\n\nThe CSVAgent node was observed to allow users to write Python code which gets executed via `pyodide`. The original intent was to allow users to utilise the `pandas` library for CSV processing. Although there is a denylist that checks for dangerous Python constructs f","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise-components","publishedAt":"2026-08-04T15:46:20Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-vmv7-4m6c-3cg5","title":"Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection \u2014 Root Shell Verified","aliases":["CVE-2026-69255"],"summary":"## UPDATE 2026-05-20: Full RCE as root VERIFIED\n\n**This is not theoretical \u2014 a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.**\n\n### Verified Exploit Chain\n\n1. Python code injection via `base64_string = \"${base64String}\"` (CSVAgent.ts line 161)\n2","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T15:40:28Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-3769-jgqc-cxm7","title":"Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override","aliases":["CVE-2026-69254"],"summary":"### Summary\nA sandbox escape vulnerability in `executeJavaScriptCode()` allows any authenticated user to execute arbitrary system commands as root on the Flowise server. The function accepts caller-provided `nodeVMOptions` that override the\n  default sandbox security settings via","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T15:29:12Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-wg86-r78f-74mp","title":"Flowise Sandbox Escape to RCE","aliases":["CVE-2026-69253"],"summary":"=============================================================================\n                                                            Security Advisory\n                                                                       elttam\n\nTopic:          Flowise JavaScript Sandbox Es","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T15:13:33Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-wp74-f5hh-5f3r","title":"Flowise: Missing authorization on `\/api\/v1\/files` allows low-privileged API keys to list and delete files across workspaces within the same organization","aliases":["CVE-2026-69252"],"summary":"# summary:\nIn Flowise, the `\/api\/v1\/files` route is protected only by the `feat:files` feature gate and does not enforce `checkPermission(...)` on either `GET` or `DELETE`. As a result, any authenticated API key within the organization, even one with unrelated permissions, can li","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T14:54:03Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-g32j-mmxr-gfq5","title":"Flowise RCE via TypeORM DataSource","aliases":["CVE-2026-69251"],"summary":"=============================================================================\n                                                            Security Advisory\n                                                                       elttam\n\nTopic:          Flowise RCE via TypeORM DataS","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T14:28:04Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-r745-8hwv-h473","title":"Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration","aliases":["CVE-2026-69250"],"summary":"### Summary\n\nThe OAuth2 token refresh endpoint (`POST \/api\/v1\/oauth2-credential\/refresh\/:credentialId`) is unauthenticated by design (it is in the public whitelist) and performs a server-side HTTP request to a credential-controlled URL (`accessTokenUrl`) without SSRF protections.","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"flowise","publishedAt":"2026-08-04T14:20:49Z","exploitedKev":false,"fixedVersion":"3.1.3","vulnerableRange":"<= 3.1.2"},{"id":"GHSA-jwv3-5hgf-82ww","title":"python-cryptography: Duplicate self-signed intermediates can cause exponential path-building","aliases":["CVE-2026-69249"],"summary":"### Summary\nWhen resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"cryptography","publishedAt":"2026-08-03T21:26:50Z","exploitedKev":false,"fixedVersion":"49.0.0","vulnerableRange":">= 42.0.0 < 49.0.0"},{"id":"GHSA-g6cj-pr64-35w5","title":"cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing","aliases":["CVE-2026-69247"],"summary":"### Summary\n\n`pkcs7_decrypt_der`, `pkcs7_decrypt_pem`, and `pkcs7_decrypt_smime` reported the\noutcome of decrypting a `RecipientInfo`'s `encryptedKey` in several\ndistinguishable ways, one of which disclosed the exact length recovered from the\nRSA operation. The same distinction w","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"cryptography","publishedAt":"2026-08-03T21:17:00Z","exploitedKev":false,"fixedVersion":"50.0.0","vulnerableRange":">= 44.0.0 < 50.0.0"},{"id":"GHSA-v5mv-p594-2x33","title":"Guzzle: Noncanonical host can bypass host-based checks","aliases":["CVE-2026-69246"],"summary":"### Impact\n\nIn affected versions, Guzzle gives a transport the request URI as text and supplies the `Host` header separately. The cURL handlers set `CURLOPT_URL` to the URI exactly as written and push that `Host` into `CURLOPT_HTTPHEADER`; `StreamHandler` does the same through `f","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"guzzlehttp\/guzzle","publishedAt":"2026-08-03T21:07:26Z","exploitedKev":false,"fixedVersion":"7.15.2","vulnerableRange":"< 7.15.2"},{"id":"GHSA-cq5v-8q36-5273","title":"AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)","aliases":["CVE-2026-69244"],"summary":"### Summary\n\nAn out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.\n\n### Impact\n\nAn attacker controlled server, or possibly an accidental response could trigger a DoS in the client.\n\n### Workaround\n\nIf unable to u","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"aiohttp","publishedAt":"2026-08-03T20:51:13Z","exploitedKev":false,"fixedVersion":"3.14.3","vulnerableRange":"<= 3.14.2"},{"id":"GHSA-v8fg-2rw7-q452","title":"Sequelize: SQL Injection (Oracle DB)","aliases":["CVE-2026-69240"],"summary":"### Summary\nSQL Injection is possible with strings only **if dialect is set to `oracle`**.\nThe vulnerability was confirmed on Sequelize v6.37.3.\n\n### Details\nThe `escape` function defined in `sql-string.js` does not escape quotes if the value starts with `TO_TIMESTAMP` or `TO_DAT","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"sequelize","publishedAt":"2026-08-03T20:29:50Z","exploitedKev":false,"fixedVersion":"6.37.4","vulnerableRange":"< 6.37.4"},{"id":"GHSA-3f7w-8rr8-f37f","title":"GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read","aliases":[],"summary":"**Target:** gitpython-developers\/GitPython\n**Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version 2.50.1`\n**Reported instances:** 2 exploitable, from a sweep of 14 unguarded call sites\n\n## Summary\n\nGitPython blocks dangerous git options through `Git.check_u","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"GitPython","publishedAt":"2026-08-03T20:09:56Z","exploitedKev":false,"fixedVersion":"3.1.57","vulnerableRange":"<= 3.1.56"},{"id":"GHSA-mwp4-54f8-5fhr","title":"ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass","aliases":["CVE-2026-69192"],"summary":"### Summary\n\n`Address4` accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, `inet_aton`, and `getaddrinfo` all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string name","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"ip-address","publishedAt":"2026-08-03T19:59:44Z","exploitedKev":false,"fixedVersion":"10.3.1","vulnerableRange":"<= 10.3.0"},{"id":"GHSA-4cwx-7wf7-3272","title":"undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives","aliases":["CVE-2026-13697"],"summary":"### Summary\n\nTwo issues in undici's cache interceptor, both fixed by the same patch on `lib\/util\/cache.js`:\n\n1. **Shared-cache disclosure:** Responses with malformed qualified `Cache-Control: private` directives such as `private=\"\"` or `private=\",\"` can be incorrectly stored in t","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"undici","publishedAt":"2026-08-03T19:19:47Z","exploitedKev":false,"fixedVersion":"7.29.0","vulnerableRange":">= 7.0.0 < 7.29.0"},{"id":"GHSA-7p8r-x3mc-p8w7","title":"fast-uri vulnerable to host confusion via backslash authority introducer","aliases":["CVE-2026-18446"],"summary":"### Impact\n\n`fast-uri` v4.1.1 and earlier require a literal `\/\/` to recognize a URI authority, so a reference that uses `\\\\`, `\/\\`, or `\\\/` as the authority introducer (in place of `\/\/`, after an optional scheme) is parsed with no authority: the sequence and everything after it f","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"fast-uri","publishedAt":"2026-08-03T19:16:43Z","exploitedKev":false,"fixedVersion":"2.4.4","vulnerableRange":"< 2.4.4"},{"id":"GHSA-2m8v-j782-fhvr","title":"Socket.IO: Zero-attachment Memory Exhaustion","aliases":["CVE-2026-69185"],"summary":"### Impact\n\nA specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.\n\n### Patches\n\n| Version range    | Used by                                    | Fixed v","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"socket.io-parser","publishedAt":"2026-08-03T19:09:44Z","exploitedKev":false,"fixedVersion":"4.2.7","vulnerableRange":">= 4.0.0 < 4.2.7"},{"id":"GHSA-rgw5-rvv9-x895","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","aliases":["CVE-2026-69152"],"summary":"### Summary\n\nThe `maxLength` mitigation added in `5.0.8` for GHSA-mh99-v99m-4gvg \/ CVE-2026-14257 is incomplete. It bounds the accumulator where results are *combined*, but not the intermediate arrays that feed it. A ~25 KB input still crashes the Node process with an **uncatchab","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"brace-expansion","publishedAt":"2026-08-03T16:35:32Z","exploitedKev":false,"fixedVersion":"1.1.18","vulnerableRange":"< 1.1.18"},{"id":"GHSA-jj27-h5hq-8x99","title":"Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes","aliases":["CVE-2026-69151"],"summary":"A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as `onclick` and `onerror` through standard attribute validation (`validateAttribute(","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@angular\/compiler","publishedAt":"2026-08-03T16:23:40Z","exploitedKev":false,"fixedVersion":"22.0.1","vulnerableRange":">= 22.0.0-next.0 < 22.0.1"},{"id":"GHSA-vpx6-8pjr-4g3v","title":"Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)","aliases":["CVE-2026-69149"],"summary":"A Cross-Site Scripting (XSS) vulnerability exists in `@angular\/platform-server`'s DOM emulation dependency (`domino`) when serializing the content of fallback raw-content elements (`<iframe>`, `<noembed>`, `<noframes>`, and `<noscript>`).\n\nWhen rendering dynamic text content insi","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@angular\/platform-server","publishedAt":"2026-08-03T16:14:43Z","exploitedKev":false,"fixedVersion":"22.0.7","vulnerableRange":">= 22.0.0-next.0 < 22.0.7"},{"id":"GHSA-jhpw-976m-542j","title":"Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning","aliases":["CVE-2026-68945"],"summary":"Angular's `HttpTransferCache` caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration.\n\nDuring SSR, `HttpTransferCache` previously generated identical key material for distinct request parameters when repeated values we","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@angular\/common","publishedAt":"2026-08-03T15:59:13Z","exploitedKev":false,"fixedVersion":"22.0.2","vulnerableRange":">= 22.0.0-next.0 < 22.0.2"},{"id":"GHSA-9xx9-hw38-h2w9","title":"Duplicate Advisory: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)","aliases":[],"summary":"# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-3rp5-jjmw-4wv2. This link is maintained to preserve external references.\n\n# Original Description\nGitPython before 3.1.53 fails to properly escape section names in git config files, allowing at","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-08-03T15:32:49Z","exploitedKev":false,"fixedVersion":"3.1.53","vulnerableRange":"<= 3.1.52"},{"id":"GHSA-p2x7-4c4p-8wh6","title":"Duplicate Advisory: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read\/write","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-vh22-h7hf-www7. This link is maintained to preserve external references.\n\n## Original Description\n\nSiYuan versions <= v3.7.2 expose the \/api\/search\/searchEmbedBlock endpoint, which passes a ","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-03T15:32:48Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 3.7.3"},{"id":"GHSA-5w4j-hchp-r332","title":"Duplicate Advisory: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read\/write with statement stacking","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-33jq-p8c2-q3q4. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan before v3.7.3 contains a SQL injection vulnerability in the \/api\/filetree\/searchDocs ","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-03T15:32:48Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.7.2"},{"id":"GHSA-pqpf-6vqv-6w92","title":"Duplicate Advisory: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-fph3-ghq9-vw66. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAss","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan","publishedAt":"2026-08-03T15:32:48Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 3.7.3"},{"id":"GHSA-vj8j-973f-r65j","title":"Duplicate Advisory: Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-7pgq-cr25-xvc8. This link is maintained to preserve external references.\n\n### Original Description\nGrav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-03T15:32:48Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 2.0.7 <= 2.0.10"},{"id":"GHSA-mmwh-j75q-gxp8","title":"Duplicate Advisory: Grav: Path Traversal in ImageMedium::watermark() \u2014 arbitrary file disclosure via publicly-cached images","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-w3f4-8pj2-599w. This link is maintained to preserve external references.\n\n### Original Description\nGrav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"getgrav\/grav","publishedAt":"2026-08-03T15:32:48Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"= 2.0.10"},{"id":"GHSA-x7jr-gvvr-p9w7","title":"Duplicate Advisory: Path Traversal via unvalidated avID in RenderAttributeView\/AV read endpoints : reader-reachable cross-scope attribute-view disclosure","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-7hm9-v7vf-7g4w. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in at","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-03T15:32:48Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 3.7.3"},{"id":"GHSA-g64v-qqpg-v37h","title":"Duplicate Advisory: Anonymous publish-password authentication bypass via getHeadingChildrenDOM \/ getHeading*Transaction \/ getBacklinkDoc (publish mode)","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-7j72-f6wg-cxw6. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-03T15:32:47Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 3.7.3"},{"id":"GHSA-85xq-27m5-59m9","title":"Duplicate Advisory: SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-69mh-gvh4-8gp7. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHead","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/siyuan-note\/siyuan\/kernel","publishedAt":"2026-08-03T15:32:47Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.7.2"},{"id":"GHSA-2mmh-4rf8-7xg6","title":"Duplicate Advisory: SiYuan: Cross-boundary content disclosure via getBacklinkDoc\/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-36v8-mpjm-8j5r. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBack","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"siyuan","publishedAt":"2026-08-03T15:32:47Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.7.2"},{"id":"GHSA-xrqw-3rrv-vx5w","title":"Transformers save_pretrained path traversal allows arbitrary file writes through chat template names","aliases":["CVE-2026-9856"],"summary":"A vulnerability in huggingface\/transformers versions < 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictio","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"transformers","publishedAt":"2026-08-02T18:30:20Z","exploitedKev":false,"fixedVersion":"5.10.0","vulnerableRange":"< 5.10.0"},{"id":"GHSA-p4r4-8cxw-pjx7","title":"Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames\/IDs instance-wide (BOLA)","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-rj9j-8772-4h6c. This link is maintained to preserve external references.\n\n### Original Description\nVikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) ","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-08-02T15:30:21Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.24.0 <= 2.3.0"},{"id":"GHSA-3q45-2fh7-66cj","title":"Duplicate Advisory: better-auth has an external request basePath modification DoS","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-569q-mpph-wgww. This link is maintained to preserve external references.\n\n## Original Description\n\nbetter-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is n","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"better-auth","publishedAt":"2026-08-02T15:30:21Z","exploitedKev":false,"fixedVersion":"1.4.2","vulnerableRange":"< 1.4.2"},{"id":"GHSA-9jrx-vmh8-c6xw","title":"Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management","aliases":[],"summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-vvcv-vpph-h844. This link is maintained to preserve external references.\n\n### Original Description\nVikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token mana","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"code.vikunja.io\/api","publishedAt":"2026-08-02T15:30:21Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 0.22.0 <= 2.3.0"},{"id":"GHSA-mjrx-74jh-7xgw","title":"Duplicate Advisory: Guzzle: Host-only cookie scope is not preserved","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-wm3w-8rrp-j577. This link is maintained to preserve external references.\n\n## Original Description\nguzzlehttp\/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing th","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"guzzlehttp\/guzzle","publishedAt":"2026-08-01T15:30:30Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 7.15.1"},{"id":"GHSA-mqq9-gxg5-m58g","title":"Duplicate Advisory: Guzzle: URI fragments disclosed in redirect Referer headers","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-h95v-h523-3mw8. This link is maintained to preserve external references.\n\n## Original Description\n\nguzzlehttp\/guzzle versions before 7.15.1 contain an information disclosure vulnerability in","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"guzzlehttp\/guzzle","publishedAt":"2026-08-01T15:30:30Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"< 7.15.1"},{"id":"GHSA-cw2r-r7mw-j3hc","title":" Duplicate Advisory: GitPython unsafe clone option gate bypass through joined short options","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-v396-v7q4-x2qj. This link is maintained to preserve external references.\n\n## Original Description\n\nGitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short ","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-08-01T15:30:28Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"= 3.1.50"},{"id":"GHSA-6r2r-ww24-7h52","title":"Duplicate Advisory: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-2f96-g7mh-g2hx. This link is maintained to preserve external references.\n\n## Original Description\n\nGitPython before 3.1.51 contains an incomplete command injection blocklist that fails to ac","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-08-01T15:30:28Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.50"},{"id":"GHSA-m4f3-g4cq-hqrx","title":"Duplicate Advisory: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-rwj8-pgh3-r573. This link is maintained to preserve external references.\n\n## Original Description\n\nGitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_fr","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-08-01T15:30:28Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.51"},{"id":"GHSA-4vpg-pfj8-m33q","title":"Duplicate Advisory: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` \/ `Repo.blame()`","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-956x-8gvw-wg5v. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword argum","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"gitpython","publishedAt":"2026-08-01T15:30:28Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":"<= 3.1.50"},{"id":"GHSA-68jp-44vc-2x5h","title":"Duplicate Advisory: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-gcfj-64vw-6mp9. This link is maintained to preserve external references.\n\n## Original Description\naxios in a Node.js deployment using the HTTP adapter can route requests through an attacker-","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"axios","publishedAt":"2026-08-01T15:30:28Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 1.15.2 < 1.18.0"},{"id":"GHSA-7qf5-7ppr-87v8","title":"Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass","aliases":[],"summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references.\n\n## Original Description\n\nTraefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kube","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/traefik\/traefik\/v3","publishedAt":"2026-08-01T15:30:27Z","exploitedKev":false,"fixedVersion":null,"vulnerableRange":">= 3.7.0 <= 3.7.7"},{"id":"GHSA-vvp7-h4fj-m28w","title":"FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files","aliases":["CVE-2026-54910"],"summary":"### Summary\n\nThe `subtitlesHandler` endpoint (`GET \/api\/media\/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors.\n\nThe primary vector is","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/gtsteffaniak\/filebrowser\/backend","publishedAt":"2026-07-31T22:35:05Z","exploitedKev":false,"fixedVersion":"0.0.0-20260608182036-f3f4bbe80cb5","vulnerableRange":"< 0.0.0-20260608182036-f3f4bbe80cb5"},{"id":"GHSA-wf43-fpp3-cf65","title":"@apostrophecms\/seo Vulnerable to Stored XSS via Unsanitized Google Analytics \/ GTM ID Injected into Script Tag","aliases":["CVE-2026-53608"],"summary":"<img width=\"1919\" height=\"1046\" alt=\"curl\" src=\"https:\/\/github.com\/user-attachments\/assets\/8aa19ff1-7f4b-44ee-83d5-d0dd1a0269f6\" \/>\n<img width=\"1919\" height=\"775\" alt=\"xss\" src=\"https:\/\/github.com\/user-attachments\/assets\/a65012e8-9b2f-416f-94df-c00493f2ca1d\" \/>\n\n### Summary\n\nThe ","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@apostrophecms\/seo","publishedAt":"2026-07-31T21:53:56Z","exploitedKev":false,"fixedVersion":"1.5.0","vulnerableRange":"<= 1.4.2"},{"id":"GHSA-6h5j-32cf-4253","title":"Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass","aliases":["CVE-2026-53609"],"summary":"<img width=\"1919\" height=\"1046\" alt=\"proto\" src=\"https:\/\/github.com\/user-attachments\/assets\/c5c69718-6448-448d-b64b-e3db41ab6ff6\" \/>\n\n## Summary\n\n`apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary val","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"apostrophe","publishedAt":"2026-07-31T21:49:25Z","exploitedKev":false,"fixedVersion":"4.31.0","vulnerableRange":"<= 4.30.0"},{"id":"GHSA-jhr6-gm9c-rqjv","title":"sentence-transformers local model loading bypasses trust_remote_code and executes custom Python","aliases":["CVE-2026-68770"],"summary":"sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers\/util\/misc.py, where the guard condition includes an 'or os.pa","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"sentence-transformers","publishedAt":"2026-07-31T21:31:59Z","exploitedKev":false,"fixedVersion":"5.6.0","vulnerableRange":"< 5.6.0"},{"id":"GHSA-p849-8hwh-84j9","title":"NocoBase: SQL injection in \/api\/myInAppChannels:list filter to PG-superuser RCE","aliases":["CVE-2026-52887"],"summary":"## Summary\n\n`GET \/api\/myInAppChannels:list` accepts a structured `filter` query parameter. The handler for the `latestMsgReceiveTimestamp` field splices the `$lt` value directly into a `Sequelize.literal()` template string with no escape, type cast, or parameter binding. The acti","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@nocobase\/plugin-notification-in-app-message","publishedAt":"2026-07-31T19:44:59Z","exploitedKev":false,"fixedVersion":"2.0.61","vulnerableRange":"<= 2.0.60"},{"id":"GHSA-98pp-vccm-qm25","title":"Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers","aliases":["CVE-2026-53599"],"summary":"## Summary\n \n`rex_mediapool::isAllowedExtension` in `redaxo\/src\/addons\/mediapool\/lib\/mediapool.php` accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example `shell.php.any.jpg`. The check only catches the blocked extens","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"redaxo\/source","publishedAt":"2026-07-31T19:43:51Z","exploitedKev":false,"fixedVersion":"5.21.1","vulnerableRange":">= 5.18.2 < 5.21.1"},{"id":"GHSA-rxcw-mc6f-6hr3","title":"Jodit Editor: Mutation XSS in jodit clean-html via a MathML\/style rawtext carrier","aliases":["CVE-2026-58263"],"summary":"### Summary\njodit's built-in `clean-html` sanitizer can be bypassed by a MathML\/`<style>` carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value. When an application supplies attacker-influenced H","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"jodit","publishedAt":"2026-07-31T19:12:40Z","exploitedKev":false,"fixedVersion":"4.12.28","vulnerableRange":"< 4.12.28"},{"id":"GHSA-cj54-hpcc-gj6h","title":"Thumbor has path traversal via post-validation URL decoding bypass in file_loader","aliases":["CVE-2026-53502"],"summary":"The file_loader performs `unquote()` on the file path AFTER the `abspath() + startswith()` security check. An attacker can use percent-encoded path traversal sequences (`%2e%2e` for `..`) that pass the security check as literal directory names, but are then decoded to actual `..`","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"thumbor","publishedAt":"2026-07-31T19:03:54Z","exploitedKev":false,"fixedVersion":"7.8.0","vulnerableRange":"<= 7.7.7"},{"id":"GHSA-phj3-59pf-cp83","title":"Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS","aliases":["CVE-2026-53505"],"summary":"### Summary\nThumbor's `filters:proportion(<value>)` filter does not enforce an upper bound on `<value>` and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU\/memory exhaustion) and cause denial of service.\n\n### Details\n- Filter implementation:","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"thumbor","publishedAt":"2026-07-31T19:00:44Z","exploitedKev":false,"fixedVersion":"7.8.0","vulnerableRange":"<= 7.7.7"},{"id":"GHSA-5vjc-7cxw-4w6j","title":"Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter","aliases":["CVE-2026-53504"],"summary":"### Summary\nThe regular expression used to parse the `convolution` filter exhibits exponential-time backtracking for certain inputs, enabling a Regular Expression Denial of Service (ReDoS).\n\n### Details\nThe RegExp for `convolution` is defined as `convolution\\((?:\\s*((?:[-]?[\\d]+\\","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"thumbor","publishedAt":"2026-07-31T18:58:28Z","exploitedKev":false,"fixedVersion":"7.8.0","vulnerableRange":"<= 7.7.7"},{"id":"GHSA-cqjp-jf4r-h5q9","title":"Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS","aliases":["CVE-2026-53503"],"summary":"### Summary\nThumbor's `filters:convolution(<matrix>, <columns>, <should_normalize>)` filter passes the user-controlled `<columns>` value to a C extension (`thumbor\/ext\/filters\/_convolution.c`) where it is used as a divisor (for `%` and `\/`) without validating `columns > 0`. When ","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"thumbor","publishedAt":"2026-07-31T18:54:55Z","exploitedKev":false,"fixedVersion":"7.8.0","vulnerableRange":"<= 7.7.7"},{"id":"GHSA-mw3h-qjxj-6xg9","title":"Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature","aliases":["CVE-2026-53501"],"summary":"# HMAC validation bypass via multiple `.replace()` calls when removing URL signature\n\n## Summary\n\nThumbor\u2019s HMAC validation can be bypassed due to the use of Python\u2019s `.replace()` when removing the signature from the URL before validation. Since `.replace()` removes **all occurre","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"thumbor","publishedAt":"2026-07-31T18:51:54Z","exploitedKev":false,"fixedVersion":"7.8.0","vulnerableRange":"<= 7.7.7"},{"id":"GHSA-6x26-6r6f-m537","title":"Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot","aliases":["CVE-2026-53500"],"summary":"## Summary\n\nThe `ALLOWED_SOURCES` configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list (the overwhelming majority of real-world and documented configurations) are passed directly to `re.match()` without esca","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"thumbor","publishedAt":"2026-07-31T18:36:03Z","exploitedKev":false,"fixedVersion":"7.8.0","vulnerableRange":"<= 7.7.7"},{"id":"GHSA-mj3g-7xcc-x4vh","title":"@phun-ky\/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging","aliases":["CVE-2026-54737"],"summary":"### Impact\n\nA prototype pollution vulnerability exists in @phun-ky\/defaults-deep prior to version 2.0.5.\n\nThe library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply c","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@phun-ky\/defaults-deep","publishedAt":"2026-07-31T17:49:08Z","exploitedKev":false,"fixedVersion":"2.0.5","vulnerableRange":"< 2.0.5"},{"id":"GHSA-r2v3-8gwf-7ghm","title":"vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API","aliases":["CVE-2026-54725"],"summary":"## Summary\n\nThe vault-secrets-webhook reads the `vault.security.banzaicloud.io\/vault-addr` annotation from any ConfigMap or Secret being admitted and uses it as the Vault server address without any validation or allowlist. When a ConfigMap or Secret contains a value prefixed with","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/bank-vaults\/vault-secrets-webhook","publishedAt":"2026-07-31T17:45:02Z","exploitedKev":false,"fixedVersion":"1.23.1","vulnerableRange":"<= 1.22.2"},{"id":"GHSA-g956-2f74-rmv7","title":"hashi-vault-js has a path traversal and query parameter injection","aliases":["CVE-2026-55100"],"summary":"## Summary\n\nThe `hashi-vault-js` library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstre","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"hashi-vault-js","publishedAt":"2026-07-31T17:03:27Z","exploitedKev":false,"fixedVersion":"0.5.2","vulnerableRange":"<= 0.5.1"},{"id":"GHSA-5846-7qm3-r52j","title":"dssrf: any users using 1.1.1.1 DNS is impacted by SSRF","aliases":["CVE-2026-54729"],"summary":"## Summary\n\nis_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery.\n\n## POC\n\nExample to simulate 1.1.1.1 in version before 1.5.0 of dssrf:\n\n`","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"dssrf","publishedAt":"2026-07-31T16:58:42Z","exploitedKev":false,"fixedVersion":"1.0.5","vulnerableRange":"<= 1.0.4"},{"id":"GHSA-rc52-c4hv-w89p","title":"Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook","aliases":["CVE-2026-68500"],"summary":"### Impact\n  The shop payment webhook `POST \/{_locale}\/update-payment` (route\n  `sylius_mollie_shop_payment_webhook`) accepts two independent, attacker-controlled\n  parameters: `id` (the Mollie payment ID, verified against Mollie's API) and `orderId` (the\n  Sylius order ID, read ","severity":"high","sourceId":"github-advisories","ecosystem":"composer","packageName":"sylius\/mollie-plugin","publishedAt":"2026-07-31T16:52:39Z","exploitedKev":false,"fixedVersion":"2.2.8","vulnerableRange":"< 2.2.8"},{"id":"GHSA-qvv7-cg9c-w4x3","title":"Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download \/ nltk.data.load) defeats ENFORCE mode","aliases":["CVE-2026-12075"],"summary":"### Summary\n`nltk.pathsec` provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges (including obfuscated forms) and recommending strict `ENFORCE` mode for security-sensitive environments. The filter is bypass","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-07-31T16:51:29Z","exploitedKev":false,"fixedVersion":"3.10.0","vulnerableRange":"<= 3.9.4"},{"id":"GHSA-fg7f-2386-8897","title":"Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex","aliases":["CVE-2026-12061"],"summary":"### Summary\n`ReviewsCorpusReader` extracts feature annotations of the form *label* followed by a bracketed signed digit (e.g. a label then `[+2]`) from each review line, using the module-level `FEATURES` regex. The feature-label sub-pattern is unbounded \u2014 an optional greedy run o","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-07-31T16:51:09Z","exploitedKev":false,"fixedVersion":"3.10.0","vulnerableRange":"<= 3.9.4"},{"id":"GHSA-6hm5-jgcp-p838","title":"Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)","aliases":["CVE-2026-12072"],"summary":"### Summary\n   A path-traversal vulnerability in `NKJPCorpusReader` allows an attacker who can\n   influence the `fileids` argument of its public read methods (`header`, `raw`,\n   `words`, `sents`, `tagged_words`) to read files outside the corpus root. The\n   reader builds the fil","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-07-31T16:50:55Z","exploitedKev":false,"fixedVersion":"3.10.0","vulnerableRange":"<= 3.9.4"},{"id":"GHSA-xh95-f55m-82fw","title":"Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)","aliases":["CVE-2026-12074"],"summary":"### Summary\n`FramenetCorpusReader.frame(name)` interpolates a caller-supplied frame name into an XML file path that is read with the builtin `open()`, bypassing `CorpusReader.open()` and the `nltk.pathsec` sandbox \u2014 including strict `ENFORCE=True` mode. A `..\/` sequence in the na","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"nltk","publishedAt":"2026-07-31T16:50:41Z","exploitedKev":false,"fixedVersion":"3.10.0","vulnerableRange":"<= 3.9.4"},{"id":"GHSA-ghrq-5wpp-hxx5","title":"Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service","aliases":["CVE-2026-52856"],"summary":"### Summary\nA maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.\n\n### Impact\nAll wings users with an open SFTP port.\n\n### Workarounds\nClose SFTP port.","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/pterodactyl\/wings","publishedAt":"2026-07-31T16:20:25Z","exploitedKev":false,"fixedVersion":"1.13.0","vulnerableRange":"< 1.13.0"},{"id":"GHSA-pfvc-3p5h-x7h6","title":"Wings exposes node configuration secrets through egg configuration-file templating","aliases":["CVE-2026-52855"],"summary":"### Impact\n\n**Type:** Exposure of sensitive information \/ insufficiently protected credentials\nleading to privilege escalation and full node compromise.\n\nWings exposes its **entire** daemon configuration to the egg configuration-file\ntemplating engine. When Wings renders a server","severity":"critical","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/pterodactyl\/wings","publishedAt":"2026-07-31T16:16:46Z","exploitedKev":false,"fixedVersion":"1.12.3","vulnerableRange":"< 1.12.3"},{"id":"GHSA-p7w7-4929-vpj5","title":"`@dynatrace-oss\/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation","aliases":[],"summary":"### Summary\n\n`@dynatrace-oss\/dynatrace-mcp-server` v1.8.5 exposes an HTTP transport mode (`--http` flag) that performs no authentication, session validation, or origin\/host verification before dispatching MCP tool calls. Any network-reachable attacker can send a raw JSON-RPC `too","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"@dynatrace-oss\/dynatrace-mcp-server","publishedAt":"2026-07-31T16:05:57Z","exploitedKev":false,"fixedVersion":"2.0.0","vulnerableRange":"<= 1.8.7"},{"id":"GHSA-hf3j-86p7-mfw8","title":"AWS Amplify Studio UI Component Properties Has an Input Validation Issue","aliases":["CVE-2025-4318"],"summary":"### Summary\nThe AWS Amplify Studio [amplify-codegen-ui](https:\/\/github.com\/aws-amplify\/amplify-codegen-ui) is a package that generates front-end code from UI Builder entities (components, forms, views, and themes) primarily used in AWS Amplify Studio for component previews and in","severity":"critical","sourceId":"github-advisories","ecosystem":"npm","packageName":"@aws-amplify\/codegen-ui-react","publishedAt":"2026-07-30T20:57:24Z","exploitedKev":false,"fixedVersion":"2.20.3","vulnerableRange":"<= 2.20.2"},{"id":"GHSA-cg4g-m8jx-vjv2","title":"dssrf has an SSRF bypass with remove_at_symbol_in_string","aliases":["CVE-2026-54722"],"summary":"## Summary\n\n`is_url_safe` in v1.0.3 contains an SSRF bypass. `remove_at_symbol_in_string` is applied to the raw URL string **before** `new URL()` parses it. This strips the `@` that separates userinfo from host, corrupting the hostname so internal IPs are never checked.\n\n## Vulne","severity":"high","sourceId":"github-advisories","ecosystem":"npm","packageName":"dssrf","publishedAt":"2026-07-30T16:26:52Z","exploitedKev":false,"fixedVersion":"1.0.4","vulnerableRange":"<= 1.0.3"},{"id":"GHSA-c9hr-64h3-gxpc","title":"Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation","aliases":["CVE-2026-67424"],"summary":"## Summary\nThe HTTP modules that DO call the SSRF guard (`http.get`, `http.request`, `http.batch`) validate only the initial URL, then issue the request with aiohttp's default `allow_redirects=True` and perform no per-hop revalidation. An attacker hosts a public URL that 302-redi","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"flyto-core","publishedAt":"2026-07-30T14:48:16Z","exploitedKev":false,"fixedVersion":"2.26.7","vulnerableRange":"<= 2.26.6"},{"id":"GHSA-pgwh-4jj4-qm8v","title":"Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal\/metadata)","aliases":["CVE-2026-67428"],"summary":"## Summary\nNumerous HTTP-emitting modules (`core.api.http_get`, `core.api.http_post`, `graphql.query`\/`graphql.mutation`, `monitor.http_check`, `communication.slack_send`, `notification.{discord,slack,teams}.send_message`, `ai.vision_analyze` [anthropic path], `verify.visual_diff","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"flyto-core","publishedAt":"2026-07-30T14:48:05Z","exploitedKev":false,"fixedVersion":"2.26.7","vulnerableRange":"<= 2.26.6"},{"id":"GHSA-jx74-cqjv-2c67","title":"Flyto2 Core: Unauthenticated flyto-verification \/run: callback_url SSRF and internal runner-secret exfiltration","aliases":["CVE-2026-67426"],"summary":"## Summary\nThe standalone `flyto-verification` service exposes `POST \/run` with **no authentication**, on all interfaces (0.0.0.0:8344 per the shipped Dockerfile). The request body's `callback_url` is used verbatim for an outbound POST that **unconditionally attaches `X-Internal-","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"flyto-core","publishedAt":"2026-07-30T14:47:41Z","exploitedKev":false,"fixedVersion":"2.26.7","vulnerableRange":">= 2.26.6 < 2.26.7"},{"id":"GHSA-qq9q-xgm3-xv9g","title":"Flyto2 Core: LLM\/API keys leak to an attacker-controlled base_url","aliases":["CVE-2026-67425"],"summary":"## Summary\n\n`llm.chat` reads the operator's provider key from the environment (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, ...) and sends it in the `Authorization: Bearer` header to `base_url`, a parameter the caller controls. `base_url` is only checked against the SSRF guard, and the","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"flyto-core","publishedAt":"2026-07-30T14:47:16Z","exploitedKev":false,"fixedVersion":"2.26.7","vulnerableRange":"< 2.26.7"},{"id":"GHSA-hr7p-wg7r-hg9m","title":"Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted","aliases":["CVE-2026-67427"],"summary":"## Summary\n\nThe capability policy denies the `env.get` and `env.load_dotenv` modules by default, with the stated reason that they read arbitrary host environment variables (API keys, DSNs) and are a secret-exfil risk. But the workflow engine's variable resolver expands `${env.VAR","severity":"high","sourceId":"github-advisories","ecosystem":"pypi","packageName":"flyto-core","publishedAt":"2026-07-30T14:47:01Z","exploitedKev":false,"fixedVersion":"2.26.7","vulnerableRange":"< 2.26.7"},{"id":"GHSA-2956-977x-2w3r","title":"Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)","aliases":["CVE-2026-67429"],"summary":"## Summary\n\n`image.download` fetches a URL and writes the response to disk. It does not use the central path guard (`validate_path_with_env_config`, which confines writes to `FLYTO_SANDBOX_DIR`); instead it confines the output to `output_dir`, but `output_dir` is itself a caller ","severity":"critical","sourceId":"github-advisories","ecosystem":"pypi","packageName":"flyto-core","publishedAt":"2026-07-30T14:46:43Z","exploitedKev":false,"fixedVersion":"2.26.7","vulnerableRange":"< 2.26.7"},{"id":"GHSA-xpxj-f2fm-rqch","title":"OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)","aliases":["CVE-2026-67437"],"summary":"## Summary\n\nOliveTin's OAuth2 login handler stores per-login state in an in-memory map (`registeredStates`) that grows unboundedly. States are added on every `\/oauth\/login` request but are **never deleted or expired**. An unauthenticated attacker can send millions of requests to ","severity":"high","sourceId":"github-advisories","ecosystem":"go","packageName":"github.com\/OliveTin\/OliveTin","publishedAt":"2026-07-30T14:24:53Z","exploitedKev":false,"fixedVersion":"0.0.0-20260708075951-ec114e95d297","vulnerableRange":">= 0.0.0-20251024001301-45f9c18bc3ee < 0.0.0-20260708075951-ec114e95d297"}]}