Security advisories

low2026-07-24

CVE-2026-63632-ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

onnx/onnx · GHSA-p893-rvq9-2xf9

high2026-07-24

CVE-2026-57516-Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)

ray-project/ray · GHSA-hhrp-gw25-jr43

high2026-07-24

CVE-2026-59859-Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator

microsoft/kiota · GHSA-jqwh-526h-c92j

high2026-07-24

CVE-2026-59862-Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator

microsoft/kiota · GHSA-7f3j-j7jj-r3vr

high2026-07-24

CVE-2026-59861-Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator

microsoft/kiota · GHSA-xg2h-5xr2-29jw

high2026-07-24

Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in

better-auth/better-auth · GHSA-qq9h-g4jm-xgf3

high2026-07-24

@better-auth/stripe: cross-organization billing tampering in organization subscription actions

better-auth/better-auth · GHSA-h3rm-78g3-j7cp

critical2026-07-24

@better-auth/scim: account takeover and stale access via SCIM provider-id collision

better-auth/better-auth · GHSA-rjg6-39jm-rgg4

medium2026-07-24

CVE-2026-66004-BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes

ahujasid/mcp-for-blender · GHSA-4h8q-hh2j-755w

medium2026-07-24

CVE-2026-66007-Hugging Face Datasets folder-based builders allow path traversal through file_name metadata

huggingface/datasets · GHSA-379c-qx7v-6h59

low2026-07-24

ImageMagick: Heap Buffer Over-Write in X11 import with crafted window title

imagemagick/imagemagick · GHSA-76q6-2p6h-xjqr

high2026-07-24

CVE-2026-59860-Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection

microsoft/kiota · GHSA-3hrf-2gc2-mx32

high2026-07-24

CVE-2026-59939-httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

httplib2/httplib2 · GHSA-j5g9-f88f-gfj3

low2026-07-24

ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified

imagemagick/imagemagick · GHSA-h5r4-w88w-7ccr

low2026-07-24

ImageMagick: Memory Leak in ICON decoder when allocation fails

imagemagick/imagemagick · GHSA-h58x-r7f7-rh84

low2026-07-24

ImageMagick: Memory leak in VIFF encoder when allocation fails

imagemagick/imagemagick · GHSA-m596-67p7-69wh

low2026-07-24

ImageMagick: Memory Leak in MIFF encoder when allocaton fails

imagemagick/imagemagick · GHSA-r628-69v2-2f9c

low2026-07-24

ImageMagick: Memory Leak in YUV decoder when opening of blob fails

imagemagick/imagemagick · GHSA-h7f2-f9cc-h2gv

low2026-07-24

ImageMagick: Memory Leak in TIFF encoder when an allocation fails

imagemagick/imagemagick · GHSA-jfq9-q63x-rc63

low2026-07-24

ImageMagick: Memory Leak in JNG encoder when a blob could not be opened

imagemagick/imagemagick · GHSA-99w9-hv66-rfv7