Security Advisories

high2026-08-25

CVE-2026-55523-praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

View chart

mervinpraison/praisonai · GHSA-8hjw-25cg-g52h

high2026-08-25

CVE-2026-55522-PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

View chart

mervinpraison/praisonai · GHSA-hxmv-c4g6-5fqc

high2026-08-25

CVE-2026-55525-praisonaiagents web_crawl vulnerable to SSRF via redirect-following

View chart

mervinpraison/praisonai · GHSA-5r34-2g38-6569

medium2026-08-24

vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths

View chart

ferronweb/vibeio-http · GHSA-fx4f-mhw4-qm7j

medium2026-08-24

Cloudreve's remote download file paths can escape the selected destination directory

View chart

cloudreve/cloudreve · GHSA-w8j7-39hp-8x59

medium2026-08-24

Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint

View chart

cloudreve/cloudreve · GHSA-vx2m-jpxr-xv7w

high2026-08-24

CVE-2026-55477-3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

View chart

mhsanaei/3x-ui · GHSA-jm48-m3rr-9hgg

medium2026-08-24

Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

View chart

canolgun-commits/websocket · GHSA-w67g-5rqw-f597

low2026-08-24

netfoil vulnerable to improper handling of untrusted DoH response data

View chart

tinfoil-factory/netfoil · GHSA-4ph6-mjv7-3fq6

medium2026-08-24

CVE-2026-54625-django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

View chart

django-cms/django-cms · GHSA-fwjf-m4qw-9f2x

high2026-08-24

CVE-2026-54623-django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

View chart

django-cms/django-cms · GHSA-8jj7-4v57-frf5

medium2026-08-24

tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service

View chart

rust-postgres/rust-postgres · GHSA-3gjw-f78c-vvpw

medium2026-08-24

postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service

View chart

rust-postgres/rust-postgres · GHSA-rgqc-3x5p-6gwg

high2026-08-24

postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

View chart

rust-postgres/rust-postgres · GHSA-5x78-73v4-xg6w

medium2026-08-24

CVE-2026-54050-Sakai Profile Image Deletion has an IDOR

View chart

sakaiproject/sakai · GHSA-9284-fjc3-fmmj

high2026-08-24

CVE-2026-54049-Sakai Conversations has a Stored XSS Issue

View chart

sakaiproject/sakai · GHSA-w2x5-gv52-9ccv

critical2026-08-24

CVE-2026-53710-mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

View chart

ibm/mcp-context-forge · GHSA-xm98-3vcf-fph7

critical2026-08-24

CVE-2026-78329-Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

View chart

apache/camel · GHSA-v7h8-xhh6-gfj4

medium2026-08-24

CVE-2026-63621-Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

View chart

apache/camel · GHSA-vvwm-3j43-7pfm

critical2026-08-24

CVE-2026-71300-Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

View chart

apache/camel · GHSA-m5r8-w65q-8wjf