Security Advisories | GitStock

high2026-08-20

CVE-2026-55253-LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

langchain-ai/langchain-mongodb · GHSA-533j-2v4q-mw5h

critical2026-08-20

CVE-2026-54061-Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

dgraph-io/dgraph · GHSA-rrwh-6jrq-wp5v

medium2026-08-20

CVE-2026-55244-asteval has a Sandbox Escape via BaseException Subclasses

lmfit/asteval · GHSA-89v8-rhwq-hf77

medium2026-08-20

asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

lmfit/asteval · GHSA-9w56-46f6-3qhx

high2026-08-20

CVE-2026-55149-vouch-proxy has an Unbounded Multipart Cookie Allocation DoS

vouch/vouch-proxy · GHSA-qqff-5854-px68

medium2026-08-20

CVE-2026-45404-OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

open-telemetry/opentelemetry-go · GHSA-42cj-99w8-cp2p

medium2026-08-20

CVE-2026-32637-Velero vulnerable to file path traversal when extracting from backup's tarball

velero-io/velero · GHSA-j2g6-362q-6qc6

medium2026-08-19

CVE-2026-63123-Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

tinacms/tinacms · GHSA-rgr9-r7mj-mf6x

medium2026-08-19

CVE-2026-59992-Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

tinacms/tinacms · GHSA-8mq9-5fw2-5rm4

high2026-08-19

CVE-2026-63188-logto-tunnel serves files outside --experience-path via path traversal

logto-io/logto · GHSA-rxjr-6c9q-h67x

low2026-08-19

CVE-2026-61712-BuildKit has a possible runtime DoS via unbounded group parsing

moby/buildkit · GHSA-72x6-4j93-7w86

medium2026-08-19

CVE-2026-61711-BuildKit: Custom frontend could bypass Seccomp/AppArmor

moby/buildkit · GHSA-7236-3392-c5c6

medium2026-08-19

SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

ihor-sokoliuk/mcp-searxng · GHSA-hjwh-xvfw-qrwj

high2026-08-19

CVE-2026-62673-Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

getgrav/grav · GHSA-vwg3-w8w3-pc79

medium2026-08-19

CVE-2026-61807-Snipe-IT: Stored DOM XSS via table selected-count IDs

grokability/snipe-it · GHSA-c8qc-wf67-342w

medium2026-08-19

CVE-2026-55703-Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

grokability/snipe-it · GHSA-r9r3-g9fp-3q4q

high2026-08-19

CVE-2026-55694-Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

grokability/snipe-it · GHSA-3hgv-jr5j-cg9x

high2026-08-19

CVE-2026-55643-Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

grokability/snipe-it · GHSA-c6w2-j4wq-mvwg

high2026-08-19

CVE-2024-45747-GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

geoserver/geoserver · GHSA-wf6j-gr27-g7ch

medium2026-08-19

CVE-2026-54689-SearXNG MCP Server: Additional hardened-mode SSRF bypasses

ihor-sokoliuk/mcp-searxng · GHSA-wppf-h75h-6pm6