Security advisories

high2026-07-15

CVE-2026-54451-Protobuf: Unbounded recursion depth in embedded-message decoding

elixir-protobuf/protobuf · GHSA-rv48-qqj5-crxg

high2026-07-15

CVE-2026-54449-LangBot: Authenticated RCE Via MCP Configuration

langbot-app/langbot · GHSA-3pvh-63gf-j9mw

high2026-07-15

CVE-2026-54447-garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

cyberjunky/python-garminconnect · GHSA-wjhr-76vg-2hvc

medium2026-07-15

Koel has SSRF through Authenticated Subsonic podcast feed URLs

koel/koel · GHSA-8q6q-m837-fv64

high2026-07-15

CVE-2026-54493-Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

koel/koel · GHSA-6p96-cfg5-4vhp

medium2026-07-15

CVE-2026-54492-Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

koel/koel · GHSA-w79m-f3jx-779v

medium2026-07-15

CVE-2026-49280-MantisBT: REST API unauthorized Issue status change

mantisbt/mantisbt · GHSA-m7ph-9558-mrx3

high2026-07-15

CVE-2026-49273-MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php

mantisbt/mantisbt · GHSA-v84x-qvhg-f36r

critical2026-07-15

CVE-2026-47156-MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

mantisbt/mantisbt · GHSA-c2xg-qjqw-2v98

high2026-07-15

CVE-2026-47142-MantisBT: SQL Injection via history_order Configuration Value

mantisbt/mantisbt · GHSA-mw6p-33vw-46cc

critical2026-07-14

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

neorazorx/facturascripts · GHSA-hgjx-r89m-m7v4

high2026-07-14

CVE-2026-54446-NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

labs64/netlicensing-mcp · GHSA-x9vc-9ffq-p3gj

high2026-07-14

CVE-2026-61549-Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend

woodpecker-ci/woodpecker · GHSA-qf34-295c-26v8

high2026-07-14

Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

forgekeep/nebula-mesh · GHSA-7rx3-5wx3-5v76

high2026-07-14

CVE-2026-61699-nebula-mesh: Certificate revocation is never enforced at the mesh

forgekeep/nebula-mesh · GHSA-cm26-5974-52h8

medium2026-07-14

CVE-2026-55608-n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode

czlonkowski/n8n-mcp · GHSA-2cf7-hpwf-47h9

medium2026-07-14

CVE-2026-55513-nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

forgekeep/nebula-mesh · GHSA-g4x6-jcvr-9m3g

medium2026-07-14

CVE-2026-55512-nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

forgekeep/nebula-mesh · GHSA-m3cx-mwpg-32jg

high2026-07-14

CVE-2026-54629-Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

julien040/anyquery · GHSA-mf78-3rpf-r784

high2026-07-14

CVE-2026-53603-nebula-mesh: Operator session tokens stored in plaintext in the database

forgekeep/nebula-mesh · GHSA-q4vm-pq3q-8wgq