Security advisories

high2026-07-31

CVE-2026-53505-Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

thumbor/thumbor · GHSA-phj3-59pf-cp83

high2026-07-31

CVE-2026-53504-Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

thumbor/thumbor · GHSA-5vjc-7cxw-4w6j

high2026-07-31

CVE-2026-53503-Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

thumbor/thumbor · GHSA-cqjp-jf4r-h5q9

high2026-07-31

CVE-2026-53501-Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

thumbor/thumbor · GHSA-mw3h-qjxj-6xg9

high2026-07-31

CVE-2026-53500-Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

thumbor/thumbor · GHSA-6x26-6r6f-m537

high2026-07-31

CVE-2026-54737-@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

phun-ky/defaults-deep · GHSA-mj3g-7xcc-x4vh

critical2026-07-31

CVE-2026-54725-vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

bank-vaults/vault-secrets-webhook · GHSA-r2v3-8gwf-7ghm

high2026-07-31

CVE-2026-55100-hashi-vault-js has a path traversal and query parameter injection

kyndryl-open-source/hashi-vault-js · GHSA-g956-2f74-rmv7

high2026-07-31

CVE-2026-54729-dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

hackingrepo/dssrf-js · GHSA-5846-7qm3-r52j

medium2026-07-31

CVE-2026-65835-Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

projectcapsule/capsule · GHSA-jr6p-8pjj-mfx6

medium2026-07-31

CVE-2026-65834-Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

projectcapsule/capsule · GHSA-68cj-mvg9-rgm2

medium2026-07-31

CVE-2026-67550-re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

uhop/node-re2 · GHSA-ff84-5f28-78qj

medium2026-07-31

CVE-2026-68499-re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

uhop/node-re2 · GHSA-6hxr-mr5r-9836

medium2026-07-31

CVE-2026-68501-Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII

sylius/mollieplugin · GHSA-x83g-979r-f5fh

high2026-07-31

CVE-2026-68500-Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook

sylius/mollieplugin · GHSA-rc52-c4hv-w89p

high2026-07-31

CVE-2026-56819-Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

netty/netty · GHSA-93wv-jw9v-4972

high2026-07-31

CVE-2026-12075-Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

nltk/nltk · GHSA-qvv7-cg9c-w4x3

high2026-07-31

CVE-2026-12061-Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

nltk/nltk · GHSA-fg7f-2386-8897

high2026-07-31

CVE-2026-12072-Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

nltk/nltk · GHSA-6hm5-jgcp-p838

high2026-07-31

CVE-2026-12074-Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

nltk/nltk · GHSA-xh95-f55m-82fw