Security advisories

low2026-08-06

CVE-2026-55825-Contao: Possible path traversal in job download URIs

contao/contao · GHSA-grm4-wm43-9jh5

medium2026-08-06

CVE-2026-71436-Mermaid XY Charts are vulnerable to an infinite loop DoS

mermaid-js/mermaid · GHSA-2v8p-3f2j-5mp7

low2026-08-06

CVE-2026-55824-Contao crawler leaks auth credentials to external hosts

contao/contao · GHSA-3mr9-p497-58f6

medium2026-08-06

CVE-2026-71435-Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

statamic/cms · GHSA-vx89-p3j7-8xqc

medium2026-08-06

CVE-2026-71434-Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

statamic/cms · GHSA-qhr7-v3xp-vw9m

medium2026-08-06

CVE-2026-64662-Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

statamic/cms · GHSA-qh8c-7588-qfrv

medium2026-08-06

CVE-2026-64663-Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

statamic/cms · GHSA-j2vp-f2pv-5rj4

high2026-08-06

CVE-2026-64665-Statamic: Account takeover via OAuth email matching without email-verification check

statamic/cms · GHSA-93qh-5269-9wcf

medium2026-08-06

CVE-2026-64664-Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

statamic/cms · GHSA-225x-3jhx-wh4q

medium2026-08-06

CVE-2026-71433-LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

langchain-ai/langgraph · GHSA-47pj-3jcm-6whg

high2026-08-06

CVE-2026-54763-Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

traefik/traefik · GHSA-x677-9fxg-v5c5

critical2026-08-06

CVE-2026-65600-Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

traefik/traefik · GHSA-cxjq-mrr5-89rv

high2026-08-06

CVE-2026-67309-Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

traefik/traefik · GHSA-8rxv-jg7p-wvg3

medium2026-08-06

CVE-2026-54765-Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

traefik/traefik · GHSA-6p8f-p8j2-rqmv

medium2026-08-06

CVE-2026-71325-Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef

traefik/traefik · GHSA-62fc-8686-hfmq

medium2026-08-06

CVE-2026-54764-Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false

traefik/traefik · GHSA-3q9r-p662-5j8m

high2026-08-06

CVE-2026-71327-Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

traefik/traefik · GHSA-fgjj-px3w-67xx

low2026-08-06

CVE-2026-71326-Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing

traefik/traefik · GHSA-6765-c87h-8mrf

high2026-08-06

CVE-2026-71324-Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

traefik/traefik · GHSA-3ccp-42pg-hgv6

medium2026-08-05

CVE-2026-65602-Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass

traefik/traefik · GHSA-42cj-m3vj-89wv