Security advisories

medium2026-08-07

CVE-2026-71852-pypdf: Possible long runtimes/large memory usage for large CID font width ranges

py-pdf/pypdf · GHSA-fwg2-594c-jp42

critical2026-08-07

CVE-2026-71851-crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

brix/crypto-js · GHSA-rg76-677x-56q9

medium2026-08-07

CVE-2026-71850-Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

honojs/hono · GHSA-f23p-vx2j-j53r

low2026-08-07

CVE-2026-71849-Hono: Proxy Helper does not remove response headers listed in the `Connection` header

honojs/hono · GHSA-79qm-7rj5-m7r9

medium2026-08-07

CVE-2026-71848-Hono: Algorithmic Complexity DoS in Language Middleware

honojs/hono · GHSA-54fx-42gc-7vw4

low2026-08-07

CVE-2026-71847-Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

ruby/json · GHSA-9hj4-r449-hfvc

high2026-08-07

CVE-2026-67422-pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

facelessuser/pymdown-extensions · GHSA-gm37-52c6-37mw

critical2026-08-07

CVE-2026-63223-CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules

codeigniter4/codeigniter4 · GHSA-mmj4-63m4-r6h5

high2026-08-07

CVE-2026-63222-CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

codeigniter4/codeigniter4 · GHSA-hhmc-q9hp-r662

critical2026-08-07

CVE-2026-63221-CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

codeigniter4/codeigniter4 · GHSA-c9w5-rwh3-7pm9

medium2026-08-07

CVE-2026-63220-CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

codeigniter4/codeigniter4 · GHSA-7wmf-pw8j-mc78

high2026-08-07

CVE-2026-15895-jsii-diff: Command Injection via npm: package argument

aws/jsii · GHSA-wcx4-wpfv-mc5c

medium2026-08-07

CVE-2026-56818-Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

netty/netty · GHSA-p9jm-q85p-7mcp

medium2026-08-07

CVE-2026-54164-API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

api-platform/core · GHSA-9rjg-x2p2-h68h

medium2026-08-07

CVE-2026-66062-SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

sveltejs/kit · GHSA-29g2-3rmr-qm68

medium2026-08-07

CVE-2026-72744-Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

nuxt/nuxt · GHSA-7c4v-fwgw-9rf7

medium2026-08-07

CVE-2026-71557-go-git: Malicious reference names may modify files outside the reference storage

go-git/go-git · GHSA-qgq7-7hm3-q39j

high2026-08-07

CVE-2026-71556-go-git: Worktree operations may follow symlinks

go-git/go-git · GHSA-hc8v-wwc9-vgxm

high2026-08-07

CVE-2026-76220-GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

gitpython-developers/gitpython · GHSA-wvpp-8hx9-p66j

high2026-08-07

GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

gitpython-developers/gitpython · GHSA-jm78-9fvv-mhgr