Security advisories

high2026-07-24

CVE-2026-69097-GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

gitpython-developers/gitpython · GHSA-3rp5-jjmw-4wv2

critical2026-07-24

CVE-2026-73649-Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

shepherdwind/velocity.js · GHSA-7gfh-x38p-prh3

medium2026-07-24

CVE-2026-73563-@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass

backstage/backstage · GHSA-38hq-7x33-php4

medium2026-07-24

CVE-2026-62946-ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds

imagemagick/imagemagick · GHSA-h22j-f9xw-xjjm

medium2026-07-24

CVE-2026-62363-ImageMagick: Heap Buffer Over-Write in fx operation

imagemagick/imagemagick · GHSA-422r-8c97-xcg4

medium2026-07-24

CVE-2026-62343-ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

imagemagick/imagemagick · GHSA-f5m7-cqgw-8hm7

medium2026-07-24

CVE-2026-61632-PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

facelessuser/pymdown-extensions · GHSA-9xwg-3r6f-jcx2

medium2026-07-24

CVE-2026-73428-Trix: Stored XSS via HTMLParser attribute injection on paste

basecamp/trix · GHSA-53g2-mvcc-q9x3

medium2026-07-24

CVE-2026-73851-Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

microsoft/kiota · GHSA-p5rm-jg5c-8c77

medium2026-07-24

CVE-2026-59952-Valibot: record() issue paths can make flatten() throw for inherited Object property names

open-circle/valibot · GHSA-5qjj-4xww-7phc

critical2026-07-24

CVE-2026-59940-seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

lxsmnsyc/seroval · GHSA-mv8w-475r-vwqw

medium2026-07-24

CVE-2026-59949-LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

yawkat/lz4-java · GHSA-xx22-p4ch-683r

high2026-07-24

CVE-2026-59866-Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName

microsoft/kiota · GHSA-4vv7-jj25-4gh6

critical2026-07-24

CVE-2026-59865-Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

microsoft/kiota · GHSA-hq9q-27g5-qwpj

high2026-07-24

CVE-2026-59863-Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF

microsoft/kiota · GHSA-4rj6-vrwv-wr8m

high2026-07-24

CVE-2026-59867-Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

microsoft/kiota · GHSA-rg4h-fpcp-2qm8

critical2026-07-24

CVE-2026-59864-Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

microsoft/kiota · GHSA-4jwf-m4wg-8p66

medium2026-07-24

SvelteKit: Prototype pollution in file input deletion path in remote-function forms

sveltejs/kit · GHSA-866w-xmhq-wj7x

medium2026-07-24

SvelteKit: Big remote form function payloads can cause Node process to crash

sveltejs/kit · GHSA-wqjv-9729-c5q2

medium2026-07-24

CVE-2026-13769-AWS CLI: Overly permissive File Permissions

aws/aws-cli · GHSA-wfp6-f47h-hxc3