Security advisories

medium2026-07-22

CVE-2026-64643-Next.js: Unauthenticated disclosure of internal Server Function endpoints

vercel/next.js · GHSA-955p-x3mx-jcvp

high2026-07-22

CVE-2026-64642-Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

vercel/next.js · GHSA-6gpp-xcg3-4w24

high2026-07-22

CVE-2026-64641-Next.js: Denial of Service in App Router using Server Actions

vercel/next.js · GHSA-m99w-x7hq-7vfj

high2026-07-22

CVE-2024-7708-Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

jetty/jetty.project · GHSA-9299-c6m4-mjhc

medium2026-07-22

CVE-2026-8384-Eclipse Jetty: Path parameter traversal

jetty/jetty.project · GHSA-w7x5-g22v-xqhr

medium2026-07-22

CVE-2026-6790-Eclipse Jetty: HTTP Authority/Host mismatch

jetty/jetty.project · GHSA-7p3p-8qv8-m2vh

medium2026-07-22

CVE-2026-10051-Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

jetty/jetty.project · GHSA-f4v5-65jj-pcr2

high2026-07-22

CVE-2026-10050-Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

jetty/jetty.project · GHSA-2fvj-hgj9-j2gr

medium2026-07-22

CVE-2026-65589-n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data

n8n-io/n8n · GHSA-89gh-3pgc-v5h2

medium2026-07-22

CVE-2026-59943-Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

dompdf/dompdf · GHSA-j8qw-6jw8-r297

medium2026-07-22

CVE-2026-59942-Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

dompdf/dompdf · GHSA-f5gf-2cj8-52g2

medium2026-07-22

CVE-2026-59941-Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

dompdf/dompdf · GHSA-8hg6-c449-896m

low2026-07-22

CVE-2026-59821-LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

berriai/litellm · GHSA-72m8-9m7m-h278

high2026-07-22

CVE-2026-59822-LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

berriai/litellm · GHSA-7488-6r32-c95q

low2026-07-22

CVE-2026-59819-LiteLLM: Local file read via request-supplied OIDC file references

berriai/litellm · GHSA-4g5m-c9r5-49xf

medium2026-07-22

CVE-2026-59820-LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

berriai/litellm · GHSA-5jmr-gcrj-2c9q

medium2026-07-22

CVE-2026-65014-n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

n8n-io/n8n · GHSA-33q9-f52j-gc75

medium2026-07-22

CVE-2026-65596-n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

n8n-io/n8n · GHSA-gq66-9cw5-j5jm

medium2026-07-22

CVE-2026-65594-n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

n8n-io/n8n · GHSA-q5xf-xhwf-cwqf

medium2026-07-22

CVE-2026-65590-n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

n8n-io/n8n · GHSA-fpg6-x68q-5793