Security Advisories | GitStock

critical2026-08-21

CVE-2026-76904-GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

geotools/geotools · GHSA-mqjf-5f49-2fjh

medium2026-08-21

Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin

getgrav/grav · GHSA-8hgv-xc77-jmcr

medium2026-08-21

CVE-2026-63466-Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

unleash/unleash · GHSA-w4mq-xh27-6xpx

medium2026-08-21

CVE-2026-63004-Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

unleash/unleash · GHSA-5vf6-jrqr-78fj

high2026-08-21

CVE-2026-63462-Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

unleash/unleash · GHSA-r5pq-6chh-j3xp

high2026-08-21

CVE-2026-72818- NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

nltk/nltk · GHSA-qx2g-xrx7-vfh8

medium2026-08-20

CVE-2026-67448-Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

axllent/mailpit · GHSA-8r62-w5wh-fc5m

medium2026-08-20

CVE-2026-67447-Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

axllent/mailpit · GHSA-r553-m4fv-5v97

medium2026-08-20

CVE-2026-55451-gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

locize/gettext-converter · GHSA-f4jp-rw7w-ccwg

medium2026-08-20

Wagtail: Improper restriction handling on Page translation API endpoint

wagtail/wagtail · GHSA-jm5p-837g-rv8g

medium2026-08-20

Wagtail: Improper permission handling when copying snippets

wagtail/wagtail · GHSA-x5cx-w6p2-mxf2

medium2026-08-20

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

wagtail/wagtail · GHSA-c2xx-cjmh-9q8f

low2026-08-20

Wagtail: Identification of documents by SHA1 hash

wagtail/wagtail · GHSA-92hv-j533-69wc

medium2026-08-20

Winter: Reflected XSS through the search query parameter in the backend Table widget

wintercms/winter · GHSA-hq84-x37p-j6q5

medium2026-08-20

Winter: CSRF through AJAX handler names reachable as backend page actions

wintercms/winter · GHSA-p2ch-c2c3-4xm5

medium2026-08-20

Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

wintercms/winter · GHSA-5cwr-5jxg-pcf6

high2026-08-20

Winter: ImportExportController AJAX handlers bypass granular import/export permission gate

wintercms/winter · GHSA-fm29-4mq3-phg6

medium2026-08-20

Winter: My Account preview exposes another backend user's profile by record ID

wintercms/winter · GHSA-mpmw-f6h6-3g26

low2026-08-20

Winter: Stored XSS through Backend List widget image columns

wintercms/winter · GHSA-7mpf-4465-7fc2

low2026-08-20

Fleet: ORDER BY column injection on activity list endpoints

fleetdm/fleet · GHSA-rxhg-vcww-2mpw