Security Advisories | GitStock

critical2026-08-28

CVE-2026-54755-Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

klever-io/klever-go · GHSA-cgc5-v3f2-8m2v

critical2026-08-28

CVE-2026-54754-Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

klever-io/klever-go · GHSA-p7gw-2pcp-5pf8

high2026-08-28

CVE-2026-54757-Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

oscal-compass/compliance-trestle · GHSA-jw39-3688-r4rx

high2026-08-28

CVE-2026-55108-KubeVela Terraform remote loader DoS via unbounded file read

kubevela/kubevela · GHSA-fmgp-q6jx-gg3x

medium2026-08-28

gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)

gitoxidelabs/gitoxide · GHSA-2vh6-hw4j-32ww

medium2026-08-28

CVE-2026-54746-Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

hatchet-dev/hatchet · GHSA-8x7x-83cf-c3pg

high2026-08-28

CVE-2026-57584-Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

phalcon/cphalcon · GHSA-x7rj-f32v-7jjg

high2026-08-28

CVE-2026-54736-Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

phalcon/cphalcon · GHSA-8jqh-95g6-7jpj

medium2026-08-27

CVE-2026-55558-aiosmtplib: STARTTLS response injection

cole/aiosmtplib · GHSA-vxj7-4xrp-5vr4

medium2026-08-27

CVE-2026-54770-WebOb: Open redirect in Location header normalization via leading C0 control / space characters

pylons/webob · GHSA-6hx8-3wjj-gr8g

critical2026-08-27

CVE-2026-37004-LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

berriai/litellm · GHSA-6wvf-77m9-58rm

high2026-08-27

Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

crossplane/crossplane-runtime · GHSA-mf7q-r4rv-jv94

medium2026-08-27

CVE-2026-54732-libreoffice-convert vulnerable to path traversal / arbitrary file write

elwerene/libreoffice-convert · GHSA-gmxc-r82q-347r

high2026-08-27

CVE-2026-54718-silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template

silverstripe/silverstripe-advancedworkflow · GHSA-39mm-rwm3-29jp

low2026-08-27

CVE-2026-42350-Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

akuity/kargo · GHSA-g7gw-m874-7rmf

medium2026-08-27

CVE-2026-54687-n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

dangerblack/n8n-node-sqlite3 · GHSA-q7m3-rhxg-7vxr

low2026-08-27

CVE-2026-54713-cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

cakephp/queue · GHSA-r5pm-vrc5-3m73

high2026-08-27

CVE-2026-54721-silverstripe/userforms vulnerable to remote code execution via userforms email subject

silverstripe/silverstripe-userforms · GHSA-g8wr-r2v2-vqc6

medium2026-08-27

CVE-2026-54720-Silverstripe Framework: Possible XSS attack through media embed

silverstripe/silverstripe-framework · GHSA-gvrw-qqp5-jgc5

critical2026-08-27

CVE-2026-47884-Spring Framework Improper Path Limitation in XsltView

spring-projects/spring-framework · GHSA-pc63-qcmh-9cmg