Security Advisories

high2026-10-20

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

klauspost/compress · GHSA-259r-337f-4rfw · CVE-2026-63209

high2026-10-20

Crass : Large numeric exponents cause CPU and memory denial of service

rgrove/crass · GHSA-6wmf-3r64-vcwv · CVE-2026-61845

high2026-10-19

aiohttp server lacks an initial request/header timeout

aio-libs/aiohttp · GHSA-5wr8-gcqf-gqf3 · CVE-2026-111064

low2026-10-19

AIOHTTP: Secure attribute not enforced for shared cookie

aio-libs/aiohttp · GHSA-494j-54xm-rwp3 · CVE-2026-111063

high2026-10-19

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

aio-libs/aiohttp · GHSA-2g87-pp6c-29x5

medium2026-10-19

russh: Unbounded memory allocation in agent protocol server via crafted constraint records

eugeny/russh · GHSA-4wc5-f2rc-q74m · CVE-2026-111061

low2026-10-19

A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request

eugeny/russh · GHSA-j7h2-66j4-ghjf · CVE-2026-111062

medium2026-10-19

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

mljar/mercury · GHSA-2658-85cv-9wwq · CVE-2026-111059

critical2026-10-19

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

mljar/mercury · GHSA-f8c7-rwf9-fmgm · CVE-2026-111057

medium2026-10-19

agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable

theagentrouter/agent-router · GHSA-953h-535j-jg2v

medium2026-10-19

Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo

graphify-labs/graphify · GHSA-pcc4-rvhr-2pr8

critical2026-10-19

Mercury: Unauthenticated Remote Code Execution via /api/kernels

mljar/mercury · GHSA-rv4m-xm3f-3ccq · CVE-2026-111058

high2026-10-19

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

huangruiteng/loopx · GHSA-vx2m-gpq4-8j5q · CVE-2026-108372

high2026-10-16

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

getarcaneapp/arcane · GHSA-pw5q-rjx4-7f7p · CVE-2026-96627

medium2026-10-16

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

getarcaneapp/arcane · GHSA-mp22-58ff-6fhr · CVE-2026-96628

critical2026-10-16

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

lmcache/lmcache · GHSA-w5f2-9q9c-ff4h · CVE-2026-105192

high2026-10-16

kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

getkin/kin-openapi · GHSA-74vm-87hj-r66f · CVE-2026-100349

medium2026-10-16

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

bytecodealliance/wasmtime · GHSA-4ch3-9j33-3pmj · CVE-2026-58494

high2026-10-16

lopdf has a stack overflow via deeply nested PDF objects

j-f-liu/lopdf · GHSA-6fj4-rcr3-r7rr

high2026-10-16

JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS

bytedeco/javacv · GHSA-rxjv-24xq-76wc · CVE-2026-102834