Security advisories

high2026-07-14

CVE-2026-44891-Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

netty/netty · GHSA-vhch-2wf3-m8rp

high2026-07-14

CVE-2026-53604-nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

forgekeep/nebula-mesh · GHSA-2p2f-px33-4vv5

high2026-07-14

CVE-2026-54628-Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

julien040/anyquery · GHSA-hwrq-8wxh-q4xv

medium2026-07-14

Umbraco.AI discloses sensitive application configuration values

umbraco/umbraco.ai · GHSA-q3v2-xj35-9grx

high2026-07-14

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware

lin-snow/ech0 · GHSA-mqxv-9rm6-w8qc

critical2026-07-14

TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution

tiddly-gittly/tidgi-desktop · GHSA-9hc2-hjx8-q6pv

high2026-07-14

CVE-2026-54448-Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

aquasecurity/trivy · GHSA-q3fv-x8vg-qqm4

high2026-07-14

CVE-2026-54087-EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

easycorp/easyadminbundle · GHSA-8559-gwj3-q37r

high2026-07-14

TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services

almeidapaulopt/tsdproxy · GHSA-pqg7-v6wh-3pfp

low2026-07-14

CVE-2026-54335-Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__

feathersjs/feathers · GHSA-28xv-ph75-77wh

high2026-07-14

CVE-2026-50158-yutu: Arbitrary File Write via MCP `caption-download` Tool

eat-pray-ai/yutu · GHSA-2c7f-fxww-6w6c

medium2026-07-14

CVE-2026-50157-Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter

auth0/symfony · GHSA-ffq7-hh2j-r24p

critical2026-07-14

CVE-2026-54052-n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

czlonkowski/n8n-mcp · GHSA-j6r7-6fhx-77wx

high2026-07-14

CVE-2026-50141-Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation

woodpecker-ci/woodpecker · GHSA-g7mm-9vx7-jm7h

critical2026-07-14

CVE-2026-50006-Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

julien040/anyquery · GHSA-xrcf-6jh3-ggvx

high2026-07-14

CVE-2026-50131-Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

fedify-dev/fedify · GHSA-xw9q-2mv6-9fr8

high2026-07-14

CVE-2026-50125-MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion

stackloklabs/mkp · GHSA-qw5r-ppcg-f8rj

medium2026-07-14

CVE-2026-50018-Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

spectolabs/hoverfly · GHSA-42j2-w334-qxw7

high2026-07-14

CVE-2026-50013-Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

spectolabs/hoverfly · GHSA-qrh4-p6v4-mrfg

medium2026-07-14

CVE-2026-54250-K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

k3s-io/k3s · GHSA-jxr7-mqhw-9p98