Security advisories

high2026-08-06

CVE-2026-16633-PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

mozilla/pdf.js · GHSA-hq66-cqwq-w95j

medium2026-08-06

CVE-2026-71497-jsoup: Cleaner may expose markup with custom raw-text elements

jhy/jsoup · GHSA-pmhh-3w7g-xqp8

high2026-08-06

Craft CMS: Arbitrary user password reset leading to administrator account takeover

craftcms/cms · GHSA-p8x7-9vfw-p7vc

high2026-08-06

CVE-2026-72781-Craft CMS: Authenticated RCE through Twig sandbox escape

craftcms/cms · GHSA-f5wm-88jv-g5hx

medium2026-08-06

CVE-2026-14793-Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

craftcms/cms · GHSA-9p7c-v5x3-rfx8

high2026-08-06

CVE-2026-72778-Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

craftcms/cms · GHSA-265m-7826-wjqm

medium2026-08-06

league/commonmark: Denial of service via deeply nested XML output

thephpleague/commonmark · GHSA-mj63-m3rc-8ppr

high2026-08-06

league/commonmark: Denial of service via colliding heading slugs

thephpleague/commonmark · GHSA-mh25-x5hq-wrqp

high2026-08-06

league/commonmark: Denial of service via duplicate footnote definitions

thephpleague/commonmark · GHSA-jfm3-95jq-q3rf

high2026-08-06

league/commonmark: Denial of service via adjacent inline attribute blocks

thephpleague/commonmark · GHSA-g2gp-3wwq-f4ph

high2026-08-06

CVE-2026-71488-league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

thephpleague/commonmark · GHSA-2q4p-g7hv-5rgv

medium2026-08-06

CVE-2026-71478-league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

thephpleague/commonmark · GHSA-29pj-957v-52mc

high2026-08-06

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

nodeca/js-yaml · GHSA-5p4m-2wfm-xmqj

medium2026-08-06

CVE-2026-54717-Silverstripe: XSS in breadcrumbs in page list view

silverstripe/silverstripe-cms · GHSA-w3cp-g2pf-65wh

medium2026-08-06

CVE-2026-18654-AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

aws/aws-cli · GHSA-hqvf-45jj-mccq

high2026-08-06

CVE-2026-71476-Nx: Zip-Slip in the self-hosted remote cache

nrwl/nx · GHSA-vp3h-ghgh-jr7g

medium2026-08-06

CVE-2026-71439-Mermaid radar diagrams are vulnerable to DoS

mermaid-js/mermaid · GHSA-rhh3-jpg6-66xh

low2026-08-06

CVE-2026-71438-Mermaid configuration APIs allow prototype pollution

mermaid-js/mermaid · GHSA-c4c3-pg64-4m4v

medium2026-08-06

CVE-2026-50159-Mermaid allows CSS injection applying to sibling elements of the diagram

mermaid-js/mermaid · GHSA-6x64-9x62-f2gx

medium2026-08-06

CVE-2026-71437-Mermaid Architecture diagrams are vulnerable to prototype pollution

mermaid-js/mermaid · GHSA-3rrr-jr9j-h3q3