Security advisories

high2026-07-24

CVE-2026-102695-OmniFaces: Forged combined-resource IDs and related output/push boundaries

omnifaces/omnifaces · GHSA-fp43-vj7g-pg92

high2026-07-24

CVE-2026-73413-Shescape: Quadratic-time denial of service in the flag-protection

ericcornelissen/shescape · GHSA-gm3r-q2wp-hw87

medium2026-07-24

CVE-2026-73411-Shescape: Home-directory disclosure in assignment context on Unix with Dash

ericcornelissen/shescape · GHSA-q53c-4prm-w95q

critical2026-07-24

CVE-2026-73414-Shescape: Shell injection via unescaped parentheses on Windows with CMD

ericcornelissen/shescape · GHSA-w4hw-qcx7-56pr

medium2026-07-24

CVE-2026-73412-Shescape: Path disclosure on Unix with Zsh

ericcornelissen/shescape · GHSA-6v4m-fw66-8r4x

high2026-07-24

CVE-2026-16584-AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

awslabs/mcp · GHSA-29w2-fq35-v728

medium2026-07-24

CVE-2026-69160-OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

openlistteam/openlist · GHSA-86cx-wwf4-phq4

medium2026-07-24

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

openlistteam/openlist · GHSA-p6ph-3jx2-3337

high2026-07-24

CVE-2026-73509-OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

openlistteam/openlist · GHSA-95cv-r8x4-vh75

high2026-07-24

CVE-2026-73493-blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

http4s/blaze · GHSA-7ppr-r889-mcf2

high2026-07-24

CVE-2026-73495-blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

http4s/blaze · GHSA-46q4-43ph-c6fr

high2026-07-24

CVE-2026-73494-blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

http4s/blaze · GHSA-mhvj-jhpq-885v

high2026-07-24

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

poweradmin/poweradmin · GHSA-cmwh-g2h8-c222

high2026-07-24

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

poweradmin/poweradmin · GHSA-rm67-g9ch-vxff

high2026-07-24

Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

poweradmin/poweradmin · GHSA-h4hf-v6w5-897x

critical2026-07-24

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

pheditor/pheditor · GHSA-f25v-x6vr-962g

high2026-07-24

CVE-2026-14257-brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

juliangruber/brace-expansion · GHSA-mh99-v99m-4gvg

medium2026-07-24

CVE-2026-64785-swift-nio-http2: Missing CR/LF/NUL validation in header values

apple/swift-nio-http2 · GHSA-q3g2-m552-3r9c

critical2026-07-24

CVE-2026-73567-sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

juneandgreen/sm-crypto · GHSA-vh45-f885-3848

medium2026-07-24

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

cloudreve/cloudreve · GHSA-v6w6-358x-2433