Security Advisories | GitStock

medium2026-08-20

CVE-2026-54168-Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

tektoncd/pipelines-as-code · GHSA-6f2p-296r-cc28

high2026-08-20

CVE-2026-54167-Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

tektoncd/pipelines-as-code · GHSA-f5f4-3hh4-f54m

low2026-08-20

OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers

opentofu/opentofu · GHSA-22w5-2fxg-vrwx

medium2026-08-20

CVE-2026-54162-Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI

alexandre-daubois/ember · GHSA-x3g7-qrwc-f6c5

high2026-08-20

CVE-2026-54156-node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

node-opcua/node-opcua · GHSA-6wvw-vrw4-363w

high2026-08-20

CVE-2026-54155-node-opcua missing nonce verification in UserNameIdentityToken authentication

node-opcua/node-opcua · GHSA-mq36-523m-x7vv

medium2026-08-20

CVE-2026-54150-next-video: Unauthenticated arbitrary file read via /api/video request handler

muxinc/next-video · GHSA-2p39-2jf3-fv2q

low2026-08-20

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

coder/coder · GHSA-h58c-xccx-75m3

low2026-08-20

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

coder/coder · GHSA-8fxq-53rx-ph5f

medium2026-08-20

Zoo Design Studio: Memory-corruption in memory handling of lib-kcl

kittycad/modeling-app · GHSA-mc9m-6fm9-pghc

medium2026-08-20

Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service

kittycad/modeling-app · GHSA-jgvr-6x5w-hx5w

high2026-08-20

CVE-2026-75140-jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations

jhy/jsoup · GHSA-65r4-943x-97jj

medium2026-08-20

stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address

eidetic-labs/stigmem · GHSA-5p3m-vhh6-9236

medium2026-08-20

CVE-2026-55410-NocoBase backup restore schema name allows command injection

nocobase/nocobase · GHSA-p853-83gj-wjj3

high2026-08-20

CVE-2026-55253-LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

langchain-ai/langchain-mongodb · GHSA-533j-2v4q-mw5h

critical2026-08-20

CVE-2026-54061-Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

dgraph-io/dgraph · GHSA-rrwh-6jrq-wp5v

medium2026-08-20

CVE-2026-55244-asteval has a Sandbox Escape via BaseException Subclasses

lmfit/asteval · GHSA-89v8-rhwq-hf77

medium2026-08-20

asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

lmfit/asteval · GHSA-9w56-46f6-3qhx

high2026-08-20

CVE-2026-55149-vouch-proxy has an Unbounded Multipart Cookie Allocation DoS

vouch/vouch-proxy · GHSA-qqff-5854-px68

medium2026-08-20

CVE-2026-45404-OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

open-telemetry/opentelemetry-go · GHSA-42cj-99w8-cp2p