Security advisories

medium2026-08-17

CVE-2026-64865-New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

View chart →

quantumnous/new-api · GHSA-j6gc-4893-qwmp

critical2026-08-17

CVE-2026-71479-New API: Integer overflow in quota billing yields negative charges (self-crediting)

View chart →

quantumnous/new-api · GHSA-8r8v-xf7q-rcpr

medium2026-08-17

CVE-2026-64866-New API: Admin can reset passkeys for same-level or higher-privileged users

View chart →

quantumnous/new-api · GHSA-p845-629j-rcj6

high2026-08-17

CVE-2026-64868-New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

View chart →

quantumnous/new-api · GHSA-v828-m3pf-vq9q

critical2026-08-17

CVE-2026-64859-New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

View chart →

quantumnous/new-api · GHSA-6x2c-phff-wx57

high2026-08-17

CVE-2026-19693-extract-zip allows arbitrary file writes through symlink archive entries

View chart →

max-mapper/extract-zip · GHSA-7pqw-9j4j-h8q3

high2026-08-17

CVE-2026-53728-Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

View chart →

medplum/medplum · GHSA-m44r-7c5h-m6mj

critical2026-08-17

CVE-2026-55158-conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target

View chart →

wktk/conflibot · GHSA-2qvg-qr73-mqxp

high2026-08-17

CVE-2026-40345-DeepmergeTS has stack exhaustion when merging recursive object graphs

View chart →

rebeccastevens/deepmerge-ts · GHSA-ggr8-5vv4-36mx

medium2026-08-14

CVE-2026-10740-s2n-quic has excessive memory allocation

View chart →

aws/s2n-quic · GHSA-9q54-f358-3fqf

medium2026-08-14

CVE-2026-55156-Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

View chart →

ooples/token-optimizer-mcp · GHSA-76pc-mqxp-3rq5

high2026-08-14

CVE-2026-55157-Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

View chart →

ooples/token-optimizer-mcp · GHSA-49mq-fc6q-3h46

medium2026-08-14

CVE-2026-53708-ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

View chart →

ibm/mcp-context-forge · GHSA-9hgc-g3w5-67cm

medium2026-08-14

CVE-2026-63740-SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

View chart →

surrealdb/surrealdb · GHSA-8rw6-p7m8-63jp

high2026-08-14

CVE-2026-55153-mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

View chart →

swaldman/mchange-commons-java · GHSA-h84g-69h7-mw6v

high2026-08-14

CVE-2026-53660-OpenAM Insecure SSO Cookie Initialization

View chart →

openidentityplatform/openam · GHSA-fpmh-vx4h-xc33

medium2026-08-14

CVE-2026-53658-Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter

View chart →

hyperledger/fabric-ca · GHSA-xghw-p77p-3r7x

high2026-08-14

CVE-2026-53657-Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket

View chart →

lima-vm/lima · GHSA-2j9v-p4xj-cjw2

high2026-08-14

CVE-2026-53653-Grav: Unauthenticated denial of service via unbounded image derivative dimensions

View chart →

getgrav/grav · GHSA-4x9g-vw65-vvf9

high2026-08-14

CVE-2026-35219-Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

View chart →

budibase/budibase · GHSA-5fpj-28rv-84r7