Security advisories

low2026-07-29

CVE-2026-52838-Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

alextselegidis/easyappointments · GHSA-996f-334j-67g7

low2026-07-29

CVE-2026-52841-Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

alextselegidis/easyappointments · GHSA-8hm4-r66f-29wr

medium2026-07-29

CVE-2026-52837-Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

alextselegidis/easyappointments · GHSA-xgr6-pqjv-3pf8

low2026-07-29

CVE-2026-52839-Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass

alextselegidis/easyappointments · GHSA-w8xc-8g92-v77h

low2026-07-29

CVE-2026-52840-Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

alextselegidis/easyappointments · GHSA-pm5p-7w5h-jm5q

high2026-07-29

CVE-2026-55651-Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

alextselegidis/easyappointments · GHSA-4vmm-5qvc-w5p7

medium2026-07-29

olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193

8go/matrix-commander · GHSA-wchh-9x6h-7f6p

high2026-07-29

CVE-2026-11393-AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping

aws/agentcore-cli · GHSA-m4x6-gwgp-4pm7

critical2026-07-29

CVE-2026-54735-prebid-server's request forgery vulnerability allows for possible host environment data extraction

prebid/prebid-server · GHSA-4p3g-4hcj-wpvx

high2026-07-29

CVE-2026-50559-Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

quarkusio/quarkus · GHSA-qcxp-gm7m-4j5v

low2026-07-29

@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate

dynatrace-oss/dynatrace-mcp · GHSA-pc2w-4mq8-32qw

medium2026-07-29

CVE-2026-50558-Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

brightio/penelope · GHSA-f42x-p2mx-hm8r

high2026-07-29

CVE-2026-67213-nanoid: custom generators can loop indefinitely when size is zero

ai/nanoid · GHSA-2v37-7h3g-55p8

high2026-07-29

CVE-2026-67214-nanoid: non-secure generators can loop indefinitely with negative size

ai/nanoid · GHSA-28wg-ghj8-5hjv

medium2026-07-29

CVE-2026-49756-Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type

wojtekmach/req · GHSA-px9f-whj3-246m

high2026-07-29

CVE-2026-49755-Req vulnerable to unbounded archive/compression extraction triggered by response content-type

wojtekmach/req · GHSA-655f-mp8p-96gv

medium2026-07-29

CVE-2026-54081-veraPDF Parser DoS via PostScript Type 1 Font Programs

verapdf/verapdf-parser · GHSA-7c26-995w-6f47

medium2026-07-29

CVE-2026-54080-veraPDF Parser DoS via PostScript CMap Streams

verapdf/verapdf-parser · GHSA-jrmc-qg6p-94fp

medium2026-07-29

CVE-2026-54082-veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

verapdf/verapdf-validation · GHSA-cg9x-g3gm-h5h6

high2026-07-29

CVE-2026-54078-veraPDF Validation XXE via Rich Text

verapdf/verapdf-validation · GHSA-3jh7-wm29-q568