Security advisories

high2026-08-07

CVE-2026-76222-GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

gitpython-developers/gitpython · GHSA-hmq2-w58f-27jc

medium2026-08-07

CVE-2026-76217-GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

gitpython-developers/gitpython · GHSA-hh9p-6wh2-4mfc

high2026-08-07

CVE-2026-76218-GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

gitpython-developers/gitpython · GHSA-9rj7-rf2p-w77r

high2026-08-07

CVE-2026-76219-GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

gitpython-developers/gitpython · GHSA-4gmw-gg2m-w46p

medium2026-08-07

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

cure53/dompurify · GHSA-55q2-fjhq-7xh7

medium2026-08-07

CVE-2026-62996-Smarty Security stream restriction bypass through stream: resource

smarty-php/smarty · GHSA-rjhh-76wf-8xmw

medium2026-08-07

CVE-2026-62992-Smarty: Symlink path traversal out of trusted directories

smarty-php/smarty · GHSA-f6wf-28g6-769x

critical2026-08-07

Craft CMS: Passkey login accepts replayed WebAuthn assertions

craftcms/cms · GHSA-wg23-69c2-gjc8

medium2026-08-07

CVE-2026-12261-NLTK downloader allows cross-package resource and model poisoning

nltk/nltk · GHSA-ffj6-66c4-86gw

medium2026-08-06

CVE-2026-72779-Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

craftcms/cms · GHSA-957r-qf9p-67xw

medium2026-08-06

CVE-2026-71554-h2: Duplicate Host header could facilitate request smuggling

python-hyper/h2 · GHSA-6hr6-w5qg-qmwg

medium2026-08-06

CVE-2026-72782-Craft CMS: Authenticated leak of secret environment variables

craftcms/cms · GHSA-596p-6jv8-775v

medium2026-08-06

CVE-2026-72785-Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

craftcms/cms · GHSA-xxpx-f366-4xpq

medium2026-08-06

CVE-2026-14794-Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

craftcms/cms · GHSA-rvmm-v933-jgxq

low2026-08-06

CVE-2026-72783-Craft CMS: Incorrect path validation could potentially lead to path traversal

craftcms/cms · GHSA-7hxc-f267-h5q7

medium2026-08-06

Craft CMS: Stored XSS in the control panel via unescaped draft name

craftcms/cms · GHSA-2rp4-x2j7-qmcc

high2026-08-06

CVE-2026-67434-PHP_CodeSniffer gitblame report command injection via crafted filename

phpcsstandards/php_codesniffer · GHSA-hmqg-cxww-wqhq

medium2026-08-06

CVE-2026-71498-node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

uhop/node-re2 · GHSA-j4r3-hg7j-8chg

medium2026-08-06

CVE-2026-71430-node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

uhop/node-re2 · GHSA-8hcv-x26h-mcgp

high2026-08-06

ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

stephanrauh/ngx-extended-pdf-viewer · GHSA-w9hm-4m3m-fxmm