Security advisories

critical2026-07-23

CVE-2026-73421-Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

nextauthjs/next-auth · GHSA-8fpg-xm3f-6cx3

high2026-07-23

CVE-2026-73418-Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

nextauthjs/next-auth · GHSA-xmf8-cvqr-rfgj

critical2026-07-23

CVE-2026-73420-Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

nextauthjs/next-auth · GHSA-7rqj-j65f-68wh

medium2026-07-23

CVE-2026-73419-Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

nextauthjs/next-auth · GHSA-x445-f3h2-j279

critical2026-07-23

CVE-2026-16723-fastjson has a remote code execution (RCE) vulnerability

alibaba/fastjson2 · GHSA-crf3-v9rr-v7hj

medium2026-07-23

CVE-2026-16629-danger allows local OS command injection through crafted file paths

danger/danger-js · GHSA-3x93-p86w-5jvh

medium2026-07-22

n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

n8n-io/n8n · GHSA-652q-gvq3-74qv

medium2026-07-22

n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances

n8n-io/n8n · GHSA-jqwr-vx3p-r266

medium2026-07-22

n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner

n8n-io/n8n · GHSA-9cmh-xcqm-5hqr

high2026-07-22

CVE-2026-73417-JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

jupyterlab/jupyterlab · GHSA-pppj-hq3g-57pj

high2026-07-22

CVE-2026-73415-JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

jupyterlab/jupyterlab · GHSA-gx64-gj6p-pc4c

medium2026-07-22

CVE-2026-73416-JupyterLab: PyPI extension blocklist package-name canonicalization bypass

jupyterlab/jupyterlab · GHSA-89vp-jrxv-24w8

medium2026-07-22

JupyterLab PluginManager lock-rule enforcement bypass

jupyterlab/jupyterlab · GHSA-h5v5-8746-g7mm

low2026-07-22

JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)

jupyterlab/jupyterlab · GHSA-whvh-wf3x-g77j

high2026-07-22

CVE-2026-64649-Next.js: Server-Side Request Forgery in Server Actions on custom servers

vercel/next.js · GHSA-89xv-2m56-2m9x

medium2026-07-22

CVE-2026-64648-Next.js: Cache confusion of response bodies for requests with bodies

vercel/next.js · GHSA-68g3-v927-f742

medium2026-07-22

CVE-2026-64647-Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

vercel/next.js · GHSA-4633-3j49-mh5q

medium2026-07-22

CVE-2026-64646-Next.js: Unbounded Server Action payload in Edge runtime

vercel/next.js · GHSA-4c39-4ccg-62r3

high2026-07-22

CVE-2026-64645-Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

vercel/next.js · GHSA-p9j2-gv94-2wf4

medium2026-07-22

CVE-2026-64644-Next.js: Denial of Service in the Image Optimization API using SVGs

vercel/next.js · GHSA-q8wf-6r8g-63ch