Security advisories

medium2026-08-19

CVE-2026-54688-SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

View chart →

ihor-sokoliuk/mcp-searxng · GHSA-q87f-qc2r-2gw4

high2026-08-19

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

View chart →

geolens-io/geolens · GHSA-p77j-g7h5-r2vw

high2026-08-19

CVE-2026-53966-XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

View chart →

xwiki/xwiki-platform · GHSA-45ph-gxxr-gwgw

high2026-08-19

CVE-2026-53965-MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

View chart →

modelcontextprotocol/php-sdk · GHSA-7m52-jw36-44r3

high2026-08-19

CVE-2026-53964-Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

View chart →

adfinis/document-merge-service · GHSA-w47q-945m-q9pc

high2026-08-19

CVE-2026-53957-Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

View chart →

contentful/contentful-mcp-server · GHSA-2xhg-73j7-rrgx

high2026-08-19

CVE-2026-53951-Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

View chart →

copier-org/copier · GHSA-9gmc-jqmh-3rvm

medium2026-08-19

CVE-2026-53941-Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS

View chart →

inspektor-gadget/inspektor-gadget · GHSA-vjhx-2cqw-3q6q

medium2026-08-19

block_buffer: panic corrupts inline buffer position

View chart →

rustcrypto/utils · GHSA-qwgh-2vcv-g2f7

high2026-08-19

claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

View chart →

wolfe-jam/claude-faf-mcp · GHSA-rr55-jp92-8wp2

high2026-08-19

faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

View chart →

wolfe-jam/faf-mcp · GHSA-j4r7-8ph4-43g3

high2026-08-19

grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

View chart →

wolfe-jam/grok-faf-mcp · GHSA-cc2g-gq8c-r332

medium2026-08-19

CVE-2026-55236-langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

View chart →

langchain-ai/helm · GHSA-jfj5-wrj9-63x4

medium2026-08-19

CVE-2026-55235-langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

View chart →

langchain-ai/helm · GHSA-2c9q-c2q9-qgqv

medium2026-08-18

CVE-2026-73974-linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

View chart →

linuxfabrik/monitoring-plugins · GHSA-rh9c-rqvg-f7pr

high2026-08-18

CVE-2026-17106-moby/go-archive: Crafted tar archive can write outside the extraction directory

View chart →

moby/go-archive · GHSA-hfg8-hc9c-6c3h

high2026-08-18

LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

View chart →

librenms/librenms · GHSA-7gww-x7fh-jf9j

medium2026-08-18

LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users

View chart →

librenms/librenms · GHSA-7cj5-v4pp-v632

medium2026-08-18

LibreNMS Vulnerable to Remote Code Execution via AboutController

View chart →

librenms/librenms · GHSA-jf24-8g2h-2wg7

high2026-08-18

CVE-2026-71417-Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

View chart →

netflix/lemur · GHSA-pxmc-2ffp-8j67