Security advisories

high2026-08-14

CVE-2026-35511-Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

View chart →

authorizerdev/authorizer · GHSA-29rf-f4vv-pvq6

high2026-08-13

CVE-2026-73654-Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

View chart →

triggerdotdev/trigger.dev · GHSA-p28v-f755-9qrg

high2026-08-13

CVE-2026-12243-nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

View chart →

nltk/nltk · GHSA-m42h-3232-vpv3

medium2026-08-13

CVE-2026-73559-vLLM: Completion prompt lists fan out into unbounded engine requests

View chart →

vllm-project/vllm · GHSA-87x5-vmc3-756j

high2026-08-13

atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read

View chart →

dep0we/atomic-agents-stack · GHSA-rm43-82j9-r4mj

medium2026-08-13

CVE-2026-54249-Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

View chart →

pydantic/pydantic-ai · GHSA-h7p7-w5gc-xj3w

high2026-08-13

CVE-2026-54526-Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

View chart →

argoproj/argo-workflows · GHSA-48p8-g2fx-3wwm

medium2026-08-13

CVE-2026-55102-hashi-vault-js: Vault token and secret values exposed in thrown errors

View chart →

kyndryl-open-source/hashi-vault-js · GHSA-5pq8-3ffp-7w5m

medium2026-08-13

CVE-2026-55088-ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

View chart →

ether/etherpad · GHSA-vqfp-p66c-xrp9

medium2026-08-13

CVE-2026-55086-ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

View chart →

ether/etherpad · GHSA-2jwf-f4xq-f24h

medium2026-08-13

CVE-2026-55087-ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

View chart →

ether/etherpad · GHSA-fjgc-3mj7-8rg8

high2026-08-13

CVE-2026-55072-Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

View chart →

pimcore/pimcore · GHSA-2mhj-fhvg-v428

medium2026-08-13

CVE-2026-45819-baseline-browser-mapping process termination on invalid input causes denial of service

View chart →

web-platform-dx/baseline-browser-mapping · GHSA-w5vr-8v7q-w6rv

high2026-08-12

CVE-2026-55074-Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

View chart →

chofstede/ansible_jailexec · GHSA-cxgv-hp74-jj7r

high2026-08-12

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

View chart →

sipsorcery-org/sipsorcery · GHSA-pfvm-w89x-94jw

high2026-08-12

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

View chart →

sipsorcery-org/sipsorcery · GHSA-jwjp-4649-v8jp

high2026-08-12

CVE-2026-55071-MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

View chart →

sepinetam/mcp-for-stata · GHSA-49m4-vp58-wgc9

high2026-08-12

CVE-2026-54917-SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

View chart →

seaweedfs/seaweedfs · GHSA-w62w-66v9-vvgv

medium2026-08-12

CVE-2026-68970-Apache Airflow Task SDK fails to mask list-shaped JSON Variables

View chart →

apache/airflow · GHSA-f3c2-j7g8-vpp8

medium2026-08-12

CVE-2026-68969-Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext

View chart →

apache/airflow · GHSA-cjv4-7hp2-2x9h