Security advisories

high2026-07-24

CVE-2026-73499-etcd: Watch API authorization bypass via open-ended range requests

etcd-io/etcd · GHSA-xg4h-6gfc-h4m8

high2026-07-24

CVE-2026-16756-Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

smithy-lang/smithy-rs · GHSA-jvxp-qmx7-gjpx

high2026-07-24

CVE-2026-73568-libp2p: yamux connection DoS via oversized data frame

libp2p/py-libp2p · GHSA-hmj8-5xmh-5573

medium2026-07-24

CVE-2026-73647-Quasar: Prototype pollution in the extend() utility

quasarframework/quasar · GHSA-3r53-75j5-3g7j

high2026-07-24

CVE-2026-73505-Oh My Posh: Arbitrary command execution via template injection in the path segment

jandedobbeleer/oh-my-posh · GHSA-6xj8-qv9j-xcjq

medium2026-07-24

CVE-2026-73506-Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

jandedobbeleer/oh-my-posh · GHSA-fwjx-9p69-h25h

high2026-07-24

CVE-2026-102695-OmniFaces: Forged combined-resource IDs and related output/push boundaries

omnifaces/omnifaces · GHSA-fp43-vj7g-pg92

high2026-07-24

CVE-2026-73413-Shescape: Quadratic-time denial of service in the flag-protection

ericcornelissen/shescape · GHSA-gm3r-q2wp-hw87

medium2026-07-24

CVE-2026-73411-Shescape: Home-directory disclosure in assignment context on Unix with Dash

ericcornelissen/shescape · GHSA-q53c-4prm-w95q

critical2026-07-24

CVE-2026-73414-Shescape: Shell injection via unescaped parentheses on Windows with CMD

ericcornelissen/shescape · GHSA-w4hw-qcx7-56pr

medium2026-07-24

CVE-2026-73412-Shescape: Path disclosure on Unix with Zsh

ericcornelissen/shescape · GHSA-6v4m-fw66-8r4x

high2026-07-24

CVE-2026-16584-AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

awslabs/mcp · GHSA-29w2-fq35-v728

medium2026-07-24

CVE-2026-69160-OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

openlistteam/openlist · GHSA-86cx-wwf4-phq4

medium2026-07-24

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

openlistteam/openlist · GHSA-p6ph-3jx2-3337

high2026-07-24

CVE-2026-73509-OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

openlistteam/openlist · GHSA-95cv-r8x4-vh75

high2026-07-24

CVE-2026-73493-blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

http4s/blaze · GHSA-7ppr-r889-mcf2

high2026-07-24

CVE-2026-73495-blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

http4s/blaze · GHSA-46q4-43ph-c6fr

high2026-07-24

CVE-2026-73494-blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

http4s/blaze · GHSA-mhvj-jhpq-885v

high2026-07-24

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

poweradmin/poweradmin · GHSA-cmwh-g2h8-c222

high2026-07-24

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

poweradmin/poweradmin · GHSA-rm67-g9ch-vxff