Security advisories

high2026-07-24

CVE-2026-73652-vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

vantage6/vantage6 · GHSA-47w6-gwp4-w6vc

low2026-07-24

Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics

hubuum/hubuum-client-rust · GHSA-2625-rw7m-5q5x

medium2026-07-24

Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

hubuum/hubuum-client-rust · GHSA-qqc3-94qv-7fw3

medium2026-07-24

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

hubuum/hubuum-client-rust · GHSA-f45q-w629-wr25

high2026-07-24

CVE-2026-73564-frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

fatedier/frp · GHSA-26gq-p25f-99cp

high2026-07-24

CVE-2026-73561-@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

anephenix/hub · GHSA-g5vv-q72c-7j78

medium2026-07-24

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources

kite-org/kite · GHSA-c534-2w9c-x7fm

critical2026-07-24

CVE-2026-73644-OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

openidentityplatform/opendj · GHSA-p279-2cqp-84jg

critical2026-07-24

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

openidentityplatform/opendj · GHSA-68r5-9hpg-7qw9

high2026-07-24

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

pheditor/pheditor · GHSA-g3hq-hphg-8fhh

high2026-07-24

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

gitpython-developers/gitpython · GHSA-94p4-4cq8-9g67

medium2026-07-24

CVE-2026-73307-Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

budibase/budibase · GHSA-hfhx-w8p8-4hc7

high2026-07-24

CVE-2026-73410-Budibase: SSRF via DNS rebinding in the REST datasource integration

budibase/budibase · GHSA-v42f-v8xc-j435

high2026-07-24

Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

budibase/budibase · GHSA-pmpg-2mxq-6xwr

medium2026-07-24

CVE-2026-73306- Budibase: Account Enumeration via Login Lockout Response Differential

budibase/budibase · GHSA-cr7p-cr3q-h5cm

high2026-07-24

Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)

budibase/budibase · GHSA-pvcr-8mvp-w8qr

high2026-07-24

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

budibase/budibase · GHSA-2xgg-r2wc-c5r2

high2026-07-24

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

budibase/budibase · GHSA-qw6m-8fw2-2v64

medium2026-07-24

CVE-2026-73308- Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

budibase/budibase · GHSA-gh4h-34gr-87r7

high2026-07-24

CVE-2026-73406- Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

budibase/budibase · GHSA-hr66-5mqr-8mpx