Security advisories

medium2026-08-03

CVE-2026-14643-undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

nodejs/undici · GHSA-jr45-8vmc-qm54

medium2026-08-03

CVE-2026-16729-undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

nodejs/undici · GHSA-v3r7-h72x-cjcm

medium2026-08-03

CVE-2026-16728-undici vulnerable to downstream response desynchronization via retry interceptor

nodejs/undici · GHSA-8xcm-r25x-g524

high2026-08-03

CVE-2026-13697-undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

nodejs/undici · GHSA-4cwx-7wf7-3272

high2026-08-03

CVE-2026-18446-fast-uri vulnerable to host confusion via backslash authority introducer

fastify/fast-uri · GHSA-7p8r-x3mc-p8w7

high2026-08-03

CVE-2026-69185-Socket.IO: Zero-attachment Memory Exhaustion

socketio/socket.io · GHSA-2m8v-j782-fhvr

medium2026-08-03

CVE-2026-69153-PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

postcss/postcss · GHSA-fxqj-rqcc-2cmp

high2026-08-03

CVE-2026-69152-brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

juliangruber/brace-expansion · GHSA-rgw5-rvv9-x895

high2026-08-03

CVE-2026-69151-Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

angular/angular · GHSA-jj27-h5hq-8x99

high2026-08-03

CVE-2026-69149-Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

angular/angular · GHSA-vpx6-8pjr-4g3v

high2026-08-03

CVE-2026-68945-Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

angular/angular · GHSA-jhpw-976m-542j

medium2026-08-03

CVE-2026-68930-Russh: Channel-scoped server callbacks can be reached without an open channel

eugeny/russh · GHSA-m65r-rprj-r5rg

high2026-08-03

CVE-2026-13506-Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

bcgit/bc-java · GHSA-qp49-qgx5-5m26

critical2026-08-03

CVE-2026-8763-Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

bcgit/bc-java · GHSA-9pwp-9qqc-pr26

high2026-08-02

CVE-2026-9856-Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

huggingface/transformers · GHSA-xrqw-3rrv-vx5w

medium2026-08-02

CVE-2026-9335-Keras: HDF5 links can disclose local file contents

keras-team/keras · GHSA-m8wh-29wm-52mv

high2026-07-31

CVE-2026-54910-FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

gtsteffaniak/filebrowser · GHSA-vvp7-h4fj-m28w

medium2026-07-31

CVE-2016-1000305-guard-livereload has a directory traversal vulnerability

guard/guard-livereload · GHSA-g65v-27r3-5p6m

medium2026-07-31

CVE-2026-54785-gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

elyin/gemini-bridge · GHSA-c5px-58j2-7fqp

medium2026-07-31

CVE-2026-54768-WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

wp-graphql/wp-graphql · GHSA-jhh7-832h-f8hv