Security advisories

medium2026-07-20

CVE-2026-59946-Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

composer/composer · GHSA-gjfg-22fp-rrxx

medium2026-07-20

CVE-2026-59947-Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

composer/composer · GHSA-g6xq-892h-64w3

medium2026-07-20

CVE-2026-59871-node-tar: Process crash via PAX numeric path type confusion

isaacs/node-tar · GHSA-w8wr-v893-vjvp

critical2026-07-20

CVE-2026-59873-node-tar: Decompression/parse DoS via unlimited input

isaacs/node-tar · GHSA-23hp-3jrh-7fpw

high2026-07-20

CVE-2026-59874-node-tar: Negative tar entry size causes infinite loop in archive replace

isaacs/node-tar · GHSA-8x88-c5mf-7j5w

medium2026-07-20

CVE-2026-59875-node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

isaacs/node-tar · GHSA-gvwx-54wh-qm9j

high2026-07-20

CVE-2026-59725-Socket.IO: Engine.IO Polling Transport Connection Exhaustion

socketio/socket.io · GHSA-r635-g3xr-vw7x

high2026-07-20

CVE-2026-13311-shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

ljharb/shell-quote · GHSA-395f-4hp3-45gv

high2026-07-20

CVE-2026-61836-Directus: Authorization-dependent response served from unsegmented cache key

directus/directus · GHSA-c6w9-5g5j-jh2p

high2026-07-20

CVE-2026-61835-Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

directus/directus · GHSA-j5h6-vqc3-phqh

critical2026-07-20

CVE-2026-61740-LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

hkuds/lightrag · GHSA-f4vv-55c2-5789

medium2026-07-20

CVE-2026-67339-Guzzle: Proxy-Authorization headers can be sent to origin servers

guzzle/guzzle · GHSA-94pj-82f3-465w

critical2026-07-20

CVE-2026-61736-LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

hkuds/lightrag · GHSA-6x6h-qqr7-855w

medium2026-07-20

CVE-2026-59929-Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

lepture/mistune · GHSA-qfrw-5rxm-mhh2

medium2026-07-20

CVE-2026-59930-Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

lepture/mistune · GHSA-2hm2-hc3v-44h9

medium2026-07-20

CVE-2026-59924-Mistune: Arbitrary File Read via Include directive path traversal

lepture/mistune · GHSA-r4rv-85jg-w4mf

high2026-07-20

CVE-2026-59922-Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

lepture/mistune · GHSA-c8j7-8cv4-2xmq

medium2026-07-20

CVE-2026-59926-Mistune: XSS via unescaped class option in Admonition directive

lepture/mistune · GHSA-g97x-gvcm-x72h

medium2026-07-20

CVE-2026-59923-Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

lepture/mistune · GHSA-8c25-4j27-2rv3

high2026-07-20

CVE-2026-59925-Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

lepture/mistune · GHSA-4j32-57v6-6g45