Security advisories

medium2026-07-31

CVE-2026-54753-`nx graph` dev server permissive CORS policy

nrwl/nx · GHSA-g2r8-wvmj-jf5w

high2026-07-31

CVE-2026-41695-Spring Data: Unbounded property-path cache keyed by externally-supplied path string

spring-projects/security-advisories · GHSA-88fw-v6x4-3f58

medium2026-07-31

CVE-2026-54706-OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

onionshare/onionshare · GHSA-22p9-r2f5-22mf

medium2026-07-31

CVE-2026-54707-OnionShare Receive mode writes uploaded files even when file uploads are disabled

onionshare/onionshare · GHSA-v833-3823-cmhp

high2026-07-31

CVE-2026-52856-Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

pterodactyl/wings · GHSA-ghrq-5wpp-hxx5

critical2026-07-31

CVE-2026-52855-Wings exposes node configuration secrets through egg configuration-file templating

pterodactyl/wings · GHSA-pfvc-3p5h-x7h6

medium2026-07-31

CVE-2026-52857-Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

pterodactyl/wings · GHSA-q6hh-gp44-4hcm

high2026-07-31

`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

dynatrace-oss/dynatrace-mcp · GHSA-p7w7-4929-vpj5

medium2026-07-31

@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification

dynatrace-oss/dynatrace-mcp · GHSA-xrmj-5g4g-8987

medium2026-07-31

@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL

dynatrace-oss/dynatrace-mcp · GHSA-pqh8-p93p-2rx7

medium2026-07-31

CVE-2026-64607-Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

apache/httpcomponents-client · GHSA-hjcp-jmpx-g3qm

critical2026-07-30

CVE-2025-4318-AWS Amplify Studio UI Component Properties Has an Input Validation Issue

aws-amplify/amplify-codegen-ui · GHSA-hf3j-86p7-mfw8

critical2026-07-30

CVE-2026-66066-Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

rails/rails · GHSA-xr9x-r78c-5hrm

low2026-07-30

CVE-2026-54522-MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

msgpack/msgpack-ruby · GHSA-4mrv-5p47-p938

high2026-07-30

CVE-2026-54722-dssrf has an SSRF bypass with remove_at_symbol_in_string

hackingrepo/dssrf-js · GHSA-cg4g-m8jx-vjv2

high2026-07-30

CVE-2026-67424-Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

flytohub/flyto-core · GHSA-c9hr-64h3-gxpc

high2026-07-30

CVE-2026-67428-Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

flytohub/flyto-core · GHSA-pgwh-4jj4-qm8v

critical2026-07-30

CVE-2026-67426-Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

flytohub/flyto-core · GHSA-jx74-cqjv-2c67

high2026-07-30

CVE-2026-67425-Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

flytohub/flyto-core · GHSA-qq9q-xgm3-xv9g

high2026-07-30

CVE-2026-67427-Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

flytohub/flyto-core · GHSA-hr7p-wg7r-hg9m