Security advisories

medium2026-07-22

CVE-2026-56722-Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

dompdf/dompdf · GHSA-cx96-42px-69fm

high2026-07-22

CVE-2026-55851-Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

netty/netty · GHSA-q6cq-mhr2-jmr5

high2026-07-22

CVE-2026-55833-Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

netty/netty · GHSA-mvh2-crg5-v77c

high2026-07-22

CVE-2026-55831-Netty SPDY SETTINGS frame count materializes unbounded settings map

netty/netty · GHSA-6jqx-86gh-f27w

low2026-07-22

CVE-2026-55555-Dompdf: File existence oracle via font-face stylesheet declaration

dompdf/dompdf · GHSA-7x2p-4jvh-6384

low2026-07-22

CVE-2026-55554-Dompdf: Chroot Validation Bypass

dompdf/dompdf · GHSA-wvh6-f5jh-8gw4

medium2026-07-22

CVE-2026-65599-n8n: Google Service Account Private Key Exposed in JWT Header

n8n-io/n8n · GHSA-9r8p-h6cc-6qhm

high2026-07-22

CVE-2026-65592-n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

n8n-io/n8n · GHSA-9wcp-9r3j-383q

high2026-07-22

CVE-2026-65597-n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

n8n-io/n8n · GHSA-p3rg-hrf9-w9gj

high2026-07-22

CVE-2026-65598-n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

n8n-io/n8n · GHSA-g3r5-9h93-4j2c

high2026-07-22

CVE-2026-65015-n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

n8n-io/n8n · GHSA-x5vx-c2c8-m3w9

medium2026-07-22

CVE-2026-45820-fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

101arrowz/fflate · GHSA-px8p-9vwx-vf98

high2026-07-21

CVE-2026-16221-fast-uri vulnerable to host confusion via literal backslash authority delimiter

fastify/fast-uri · GHSA-v2hh-gcrm-f6hx

high2026-07-21

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

lovell/sharp · GHSA-f88m-g3jw-g9cj

high2026-07-21

CVE-2026-73569-fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

naturalintelligence/fast-xml-parser · GHSA-8r6m-32jq-jx6q

high2026-07-21

CVE-2026-67322-GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

gitpython-developers/gitpython · GHSA-rwj8-pgh3-r573

medium2026-07-21

CVE-2026-73648-Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

rails/rails-html-sanitizer · GHSA-cj75-f6xr-r4g7

medium2026-07-21

CVE-2026-73565-Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

honojs/node-server · GHSA-9mqv-5hh9-4cgg

high2026-07-21

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

grpc/grpc-go · GHSA-hrxh-6v49-42gf

low2026-07-21

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

flavorjones/loofah · GHSA-5qhf-9phg-95m2