Security Advisories | GitStock

high2026-08-26

CVE-2026-54356-Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

budibase/budibase · GHSA-6x9p-4r67-5gjx

critical2026-08-26

CVE-2026-68525-Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

apache/tomcat · GHSA-h3x4-894j-xpx5

critical2026-08-26

CVE-2026-65637-Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation

apache/tomcat · GHSA-f525-44xv-f2qj

critical2026-08-26

CVE-2026-65905-Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

apache/tomcat · GHSA-9xv2-5v5q-p794

medium2026-08-25

CVE-2026-54338-JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

jupyterhub/jupyterhub · GHSA-p43p-whwx-q52h

high2026-08-25

CVE-2026-55099-icalendar has Algorithmic Complexity in Equality

collective/icalendar · GHSA-cv84-9p8j-fj68

high2026-08-25

CVE-2026-45019-Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

chainlit/chainlit · GHSA-hvfh-5mj3-5f3j

critical2026-08-25

CVE-2026-45018-Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

chainlit/chainlit · GHSA-w3fx-mc44-mf6j

medium2026-08-25

CVE-2026-55605-@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint

arikusi/deepseek-mcp-server · GHSA-72f3-6w86-7rv3

high2026-08-25

CVE-2026-55604-@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key

arikusi/deepseek-mcp-server · GHSA-fh3r-g96v-f578

high2026-08-25

CVE-2026-55609-consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

ruvnet/sublinear-time-solver · GHSA-xc9g-j69q-37xw

high2026-08-25

CVE-2026-55629-Whistle vulnerable to path traversal

avwo/whistle · GHSA-3vfr-4gwf-qxfp

high2026-08-25

CVE-2026-55620-eml_parser vulnerable to DoS via deeply nested parens in Received headers

govcert-lu/eml_parser · GHSA-g7gc-gmgp-wgqg

medium2026-08-25

CVE-2026-55619-eml_parser has parser DoS via deeply nested parentheses in e-mail headers

govcert-lu/eml_parser · GHSA-m66c-fw79-6359

medium2026-08-25

CVE-2026-55618-eml_parser has a URL extraction bypass via HTML entities in URLs

govcert-lu/eml_parser · GHSA-fxgq-9m89-cxj9

critical2026-08-25

CVE-2026-49757-AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching

team-alembic/ash_authentication · GHSA-777c-2fxx-qr28

medium2026-08-25

CVE-2026-55663-mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

versatica/mediasoup · GHSA-p7x2-g5cq-fhmq

high2026-08-25

CVE-2026-53430-gRPC Erlang package has unbounded gzip decompression (decompression bomb)

elixir-grpc/grpc · GHSA-6ccx-9c9f-327w

high2026-08-25

CVE-2026-48854-gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`

elixir-grpc/grpc · GHSA-q8gf-9rvj-gmgj

high2026-08-25

CVE-2026-48599-gRPC Erlang package's path bindings are overridable by query string and request body

elixir-grpc/grpc · GHSA-mwr4-5g34-j5cq