Security advisories

medium2026-07-15

CVE-2026-54490-websocket-driver: Resource limit bypass via message compression

faye/websocket-driver-node · GHSA-mp7j-qc5w-4988

critical2026-07-15

CVE-2026-54466-websocket-driver: Message corruption via abuse of protocol length headers

faye/websocket-driver-node · GHSA-xv26-6w52-cph6

medium2026-07-15

CVE-2026-54465-websocket-driver: Memory exhaustion in HTTP header parser

faye/websocket-driver-ruby · GHSA-8j3g-f24p-4mpw

medium2026-07-15

CVE-2026-54464-websocket-driver: Resource limit bypass via message compression

faye/websocket-driver-ruby · GHSA-33ph-fccm-39pj

medium2026-07-15

CVE-2026-54463-websocket-driver: Memory exhaustion via abuse of protocol length headers

faye/websocket-driver-ruby · GHSA-ghhp-3qvg-889p

medium2026-07-15

CVE-2026-54254-Pixeldrain API key shared with unverified thirdparty sites

cyberdrop-dl/cyberdrop-dl · GHSA-f5pf-q7c7-m3vv

high2026-07-15

CVE-2026-54457-TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

tensorzero/tensorzero · GHSA-824w-x939-6cmc

medium2026-07-15

CVE-2026-54452-safeurl is Missing IPv6 CIDR Ranges in Blocklist

doyensec/safeurl · GHSA-xgch-x3mx-cm3c

medium2026-07-15

CVE-2026-53656-FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

voxel51/fiftyone · GHSA-q78p-hj9h-5466

high2026-07-15

obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

coddingtonbear/obsidian-local-rest-api · GHSA-62gx-5q78-wrvx

low2026-07-15

CVE-2026-54450-ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway

stacklok/toolhive · GHSA-pph6-vfjv-vpjw

high2026-07-15

CVE-2026-62944-MantisBT: Stored XSS in print_all_bug_page_word.php

mantisbt/mantisbt · GHSA-h2wf-967x-gxvw

medium2026-07-15

CVE-2026-52883-MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs

mantisbt/mantisbt · GHSA-4vpf-w7qv-5h3q

medium2026-07-15

CVE-2026-52882-MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters

mantisbt/mantisbt · GHSA-3v2j-6fw9-f57c

critical2026-07-15

CVE-2026-52881-MantisBT: Reflected XSS in admin/install.php via unescaped printf

mantisbt/mantisbt · GHSA-vcrw-4xvv-jh49

high2026-07-15

CVE-2026-58659- PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters

lightning-ai/pytorch-lightning · GHSA-qqmf-gpg7-g8gw

critical2026-07-15

CVE-2026-52847-MantisBT: Reflected XSS in admin/install.php

mantisbt/mantisbt · GHSA-77x8-3v3h-hrhv

medium2026-07-15

CVE-2026-54494-Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

koel/koel · GHSA-rjg7-r26h-cfp2

medium2026-07-15

CVE-2026-50552-Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

koel/koel · GHSA-jr4p-4xjh-fwvw

high2026-07-15

CVE-2026-54491-Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

koel/koel · GHSA-6qvr-wjmv-v8mm