Security advisories

critical2026-07-28

CVE-2026-54588-Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

poweradmin/poweradmin · GHSA-3735-5339-xfwx

high2026-07-28

CVE-2026-54609-QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

quiet-terminal-interactive/qtineon · GHSA-85rg-p3fr-xc2f

high2026-07-28

CVE-2026-54603-OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

ruby-oauth/oauth2 · GHSA-pp92-crg2-gfv9

high2026-07-28

CVE-2026-54605-OAuth: Cross-origin token-request redirects can expose signed request metadata

ruby-oauth/oauth · GHSA-prq8-7wvh-44qh

low2026-07-28

CVE-2026-54620-sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

sparklemotion/sqlite3-ruby · GHSA-j7fr-3v8c-3qc3

low2026-07-28

CVE-2026-54619-sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

sparklemotion/sqlite3-ruby · GHSA-28hh-pr2h-2w89

medium2026-07-28

CVE-2026-54332-GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

gopacket/gopacket · GHSA-g6v3-7xmc-w563

medium2026-07-28

CVE-2026-54345-GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

gopacket/gopacket · GHSA-6r28-9ppf-4hj5

medium2026-07-28

nono-cli'scregistry pack verification can fail open when provenance metadata is absent

always-further/nono · GHSA-hc4m-q9jh-xw4j

high2026-07-28

CVE-2026-54593-Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

pterodactyl/panel · GHSA-8r6w-3qq5-4p4r

medium2026-07-28

@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition

novuhq/novu · GHSA-vg6v-j97m-h5xq

high2026-07-28

CVE-2026-61609-Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

pterodactyl/panel · GHSA-xvc3-826v-xf47

high2026-07-28

CVE-2026-55771-Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

cedar-policy/cedar-java · GHSA-4r9r-4425-74p7

high2026-07-28

CVE-2026-54545-@wakaru/cli arbitrary file write during bundle unpack

pionxzh/wakaru · GHSA-7wpj-vvmv-pgm8

high2026-07-28

CVE-2026-47427-GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler

github/github-mcp-server · GHSA-w4q6-qw23-4rg7

critical2026-07-28

CVE-2026-46428-lettre has TLS hostname verification disabled when using Boring TLS backend

lettre/lettre · GHSA-4pj9-g833-qx53

high2026-07-28

CVE-2026-45293-WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

wordpress/wordpress-coding-standards · GHSA-3pwp-g2mj-5p3v

high2026-07-28

CVE-2026-43910-java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

appium/java-client · GHSA-28f5-38xr-jh2w

medium2026-07-28

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method

pocket-id/pocket-id · GHSA-hp74-gm6m-2qm5

high2026-07-28

CVE-2026-43983-Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

pocket-id/pocket-id · GHSA-w6p7-2fxx-4f44