Security advisories

high2026-07-16

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

arcadedata/arcadedb · GHSA-48qw-824m-86pr

critical2026-07-16

CVE-2026-55579-Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

pheditor/pheditor · GHSA-p4h7-p9rj-2pq2

high2026-07-16

CVE-2026-55578-Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

pheditor/pheditor · GHSA-wg4w-wr5q-6vjc

medium2026-07-16

CVE-2026-52724-kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

kumahq/kuma · GHSA-wvmp-6r4v-j6cv

high2026-07-16

CVE-2026-54076-ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

arcadedata/arcadedb · GHSA-vg6x-6pg9-6qwg

high2026-07-16

CVE-2026-54077-ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

arcadedata/arcadedb · GHSA-8w86-m9h8-hvqg

low2026-07-16

CVE-2026-54542-nimiq-primitives: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

nimiq/core-rs-albatross · GHSA-5rg2-xv9j-gv5p

low2026-07-16

CVE-2026-54541-nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys

nimiq/core-rs-albatross · GHSA-46wq-28cx-mhw4

high2026-07-16

CVE-2026-54540-Pheditor has an authenticated terminal command whitelist bypass

pheditor/pheditor · GHSA-9643-6xjp-vx57

high2026-07-16

CVE-2026-52869-MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

modelcontextprotocol/python-sdk · GHSA-jpw9-pfvf-9f58

high2026-07-16

CVE-2026-52870-MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

modelcontextprotocol/python-sdk · GHSA-hvrp-rf83-w775

medium2026-07-16

CVE-2026-52832-Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

nuclio/nuclio · GHSA-wpcj-rmv4-86qg

high2026-07-16

CVE-2026-52833-Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

nuclio/nuclio · GHSA-3v79-m2cg-89ww

high2026-07-16

CVE-2026-53714-Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode

envoyproxy/gateway · GHSA-22xc-xg2r-9j7v

medium2026-07-16

Diesel has possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`

diesel-rs/diesel · GHSA-ggxf-9f6j-w742

critical2026-07-16

CVE-2026-53713-Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

envoyproxy/gateway · GHSA-wcrf-9vrr-854f

medium2026-07-16

CVE-2026-53715-Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock

envoyproxy/gateway · GHSA-8fv2-88gg-hm7q

medium2026-07-16

CVE-2026-53717-Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header

envoyproxy/gateway · GHSA-h7pq-86h8-rp5x

medium2026-07-16

CVE-2026-53719-Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

envoyproxy/gateway · GHSA-m2v6-2jmh-4c68

medium2026-07-16

CVE-2026-53716-Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

envoyproxy/gateway · GHSA-cxpq-8v7q-cg56