Security Advisories | GitStock

high2026-08-18

CVE-2026-69219-RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

rabbitmq/rabbitmq-java-client · GHSA-68mj-5wr7-6fgg

high2026-08-18

CVE-2026-69220-RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

rabbitmq/rabbitmq-java-client · GHSA-93j5-89vc-pph4

medium2026-08-18

CVE-2026-63328-Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write

aquasecurity/trivy · GHSA-8rc5-4fr6-64pw

high2026-08-18

CVE-2026-55839-Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection

kestra-io/kestra · GHSA-34pm-923j-7wf8

high2026-08-18

@rhinostone/swig: arbitrary local file read via include/extends path traversal

gina-io/swig · GHSA-2mf3-mr2r-r4vf

medium2026-08-18

CVE-2026-70657-Copyparty vulnerable to file/dirkey confusion

9001/copyparty · GHSA-x5pq-m9p8-f4vx

high2026-08-17

CVE-2026-69148-MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id

mlflow/mlflow · GHSA-gqch-g4w5-7qcw

medium2026-08-17

CVE-2026-69146-MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

mlflow/mlflow · GHSA-3p64-6gvh-82v5

critical2026-08-17

CVE-2026-64849-MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

mlflow/mlflow · GHSA-7gwp-5pfp-969j

high2026-08-17

CVE-2026-56677-9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

decolua/9router · GHSA-8g4w-4ffg-8vgx

high2026-08-17

CVE-2026-54148-http4k: `DigestAuthProvider.verify` did not bind to request URI

http4k/http4k · GHSA-p28p-j94q-pg32

medium2026-08-17

CVE-2026-54147-http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

http4k/http4k · GHSA-vxxm-wwqh-mh47

medium2026-08-17

CVE-2026-53766-chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

chromedevtools/chrome-devtools-mcp · GHSA-8qf9-62x2-82pp

medium2026-08-17

package pkcs12: Authentication bypass in Decode functions

sslmate/go-pkcs12 · GHSA-mpwr-8vm7-h73f

high2026-08-17

CVE-2026-53752-docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

plutext/docx4j · GHSA-gc95-3vw8-vg43

high2026-08-17

CVE-2026-53659-http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS

http4k/http4k · GHSA-g4w2-6h2r-3m3w

high2026-08-17

atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard

dep0we/atomic-agents-stack · GHSA-j659-8xh6-5pq5

high2026-08-17

atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)

dep0we/atomic-agents-stack · GHSA-xhcr-cqfr-m3hv

medium2026-08-17

CVE-2026-59903-Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

netty/netty · GHSA-8c42-7qj2-3j46

high2026-08-17

CVE-2026-59902-Netty: Memory Exhaustion in SctpMessageCompletionHandler

netty/netty · GHSA-2qj4-mmr9-4v2f