Security Advisories | GitStock

medium2026-08-18

CVE-2026-71322-Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

netflix/lemur · GHSA-4h97-p9wq-chqj

medium2026-08-18

CVE-2026-71317-Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

netflix/lemur · GHSA-g7p5-89mh-248h

high2026-08-18

CVE-2026-71308-Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

netflix/lemur · GHSA-cfh6-pv5c-38jv

high2026-08-18

CVE-2026-71307-Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

netflix/lemur · GHSA-6c8m-q6g9-vrw3

high2026-08-18

CVE-2026-71303-Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

netflix/lemur · GHSA-v5rc-cpwc-cfpr

medium2026-08-18

CVE-2026-70667-Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

netflix/lemur · GHSA-f3qq-49m6-rw8f

high2026-08-18

CVE-2026-70666-Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

netflix/lemur · GHSA-xpmj-wjcp-6pww

medium2026-08-18

CVE-2026-65959-Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

vitessio/vitess · GHSA-mhc4-g3wh-cw7m

critical2026-08-18

CVE-2026-62988-Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

froxlor/froxlor · GHSA-7788-ghfq-c6mh

medium2026-08-18

CVE-2026-55593-Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection

froxlor/froxlor · GHSA-xpr4-8vp6-c87j

medium2026-08-18

CVE-2026-54543-Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

froxlor/froxlor · GHSA-5rw4-4665-cvwf

high2026-08-18

CVE-2026-54348-Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

froxlor/froxlor · GHSA-w27m-rmmf-g5w4

high2026-08-18

CVE-2026-54347-Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

froxlor/froxlor · GHSA-43gm-9rr3-cx7g

medium2026-08-18

CVE-2026-54723-devpi-server may leak database contents

devpi/devpi · GHSA-m5pq-69xg-vcq3

high2026-08-18

CVE-2026-55224-MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

mineadmin/mineadmin · GHSA-59xm-4m8c-g3xj

high2026-08-18

MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files

project-monai/monai · GHSA-wg9g-w2j2-8pgr

high2026-08-18

MONAI vulnerable to OS command injection

project-monai/monai · GHSA-rghg-q7wp-9767

high2026-08-18

Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch

project-monai/monai · GHSA-qxq5-qhx6-94qw

medium2026-08-18

Triton VM Soundness Vulnerability due to Missing Constraint

tritonvm/triton-vm · GHSA-vjf8-9fx6-mv6x

critical2026-08-18

CVE-2026-54133-jmespath.php has CompilerRuntime code injection via unescaped function names

jmespath/jmespath.php · GHSA-pcw8-m77r-2528