Security advisories

medium2026-08-18

CVE-2026-53423-membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

View chart →

membraneframework/membrane_mp4_plugin · GHSA-43hj-fxwj-49qw

critical2026-08-18

CVE-2026-55211-surfio has an out-of-bounds read

View chart →

equinor/surfio · GHSA-rcr2-hggw-43wm

critical2026-08-18

CVE-2026-55209-resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

View chart →

equinor/resdata · GHSA-pr85-w493-9w3x

critical2026-08-18

CVE-2026-55107-kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

View chart →

elct9620/kobako · GHSA-7pwq-q9jf-539h

high2026-08-18

MeshCentral has unsanitized data fields

View chart →

ylianst/meshcentral · GHSA-c7hr-448w-65px

critical2026-08-18

CVE-2026-18963-Keycloak: Unauthenticated account takeover via reset-credentials flow bypass

View chart →

keycloak/keycloak · GHSA-4gv3-mc9p-5wqc

medium2026-08-18

CVE-2026-68922-MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

View chart →

mobsf/mobile-security-framework-mobsf · GHSA-8j49-mmcx-4mp5

medium2026-08-18

CVE-2026-68923-MobSF's CSRF checks not enforced after Django migration

View chart →

mobsf/mobile-security-framework-mobsf · GHSA-3p54-567p-2wpr

low2026-08-18

CVE-2026-68927-MobSF has SSRF port restriction bypass in assetlinks_check

View chart →

mobsf/mobile-security-framework-mobsf · GHSA-95px-34x5-p37h

medium2026-08-18

CVE-2026-68924-MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

View chart →

mobsf/mobile-security-framework-mobsf · GHSA-x768-8642-mmq9

medium2026-08-18

CVE-2026-63640-MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

View chart →

magicmirrororg/magicmirror · GHSA-q4gh-4ffp-5cg8

high2026-08-18

CVE-2026-55178-GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

View chart →

geolens-io/geolens · GHSA-p23g-mvhj-jh3j

high2026-08-18

CVE-2026-55182-LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module

View chart →

librenms/librenms · GHSA-c9fv-cgmm-2wg7

medium2026-08-18

CVE-2026-63643-MagicMirror: ssrf calendar .js

View chart →

magicmirrororg/magicmirror · GHSA-w6x9-28jw-hq7j

medium2026-08-18

CVE-2026-63642-MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

View chart →

magicmirrororg/magicmirror · GHSA-998g-7v5w-cr7g

low2026-08-18

CVE-2026-63641-MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

View chart →

magicmirrororg/magicmirror · GHSA-w26r-fwg8-rcp3

low2026-08-18

CVE-2026-61634-RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

View chart →

rabbitmq/rabbitmq-java-client · GHSA-5xwg-cfvj-gff5

medium2026-08-18

CVE-2026-63336-RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

View chart →

rabbitmq/rabbitmq-java-client · GHSA-5m9f-rphj-c435

medium2026-08-18

CVE-2026-63335-RabbitMQ Java client malformed body frame triggers raw command assembler exception

View chart →

rabbitmq/rabbitmq-java-client · GHSA-qx7j-jv8m-fppr

high2026-08-18

CVE-2026-63337-RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

View chart →

rabbitmq/rabbitmq-java-client · GHSA-6g32-pxv4-2wfj