Security advisories

low2026-07-14

CVE-2025-61670-Wasmtime: Memory leak in C API with `externref` and `anyref` types

bytecodealliance/wasmtime · GHSA-vvp9-h8p2-xwfc

low2026-07-14

CVE-2026-45710-FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`

neorazorx/facturascripts · GHSA-3x7p-v8hj-xh5m

high2026-07-14

CVE-2026-45263-FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

neorazorx/facturascripts · GHSA-2p5x-4jr6-x5jg

high2026-07-14

CVE-2026-45693-FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents

neorazorx/facturascripts · GHSA-cv65-7cg8-r623

critical2026-07-14

CVE-2026-45262-FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

neorazorx/facturascripts · GHSA-5qmh-x653-g8qj

high2026-07-14

CVE-2026-44300-OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

opencost/opencost · GHSA-wmj8-9953-vff5

high2026-07-14

CVE-2026-15736-Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities

snowflakedb/snowflake-sqlalchemy · GHSA-8g6f-qw9x-4q6q

low2026-07-14

CVE-2026-12482-Keras: tar extraction permits symlink-based path traversal

keras-team/keras · GHSA-58hv-7753-xmfq

medium2026-07-14

CVE-2026-52828-Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

kimai/kimai · GHSA-rw46-qg69-vg6h

high2026-07-14

CVE-2026-52827-Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP

kimai/kimai · GHSA-v8hx-4vx8-wc96

high2026-07-14

CVE-2026-62240-crewai-tools SSRF redirect bypass exposes internal services

crewaiinc/crewai · GHSA-mr4r-hcgx-8p4h

medium2026-07-14

CVE-2026-52826-Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

kimai/kimai · GHSA-2xgg-2x8h-8xw4

medium2026-07-14

CVE-2026-52825-Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility

kimai/kimai · GHSA-xv4r-4885-gwpg

critical2026-07-14

CVE-2026-52824-Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

kimai/kimai · GHSA-jr9p-4h4j-6c58

medium2026-07-14

CVE-2026-52823-Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

kimai/kimai · GHSA-r8vr-m544-qh4h

medium2026-07-14

CVE-2026-52822-Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

kimai/kimai · GHSA-c6w6-57jj-62vh

medium2026-07-14

CVE-2026-52821-Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

kimai/kimai · GHSA-3q6q-26vg-v97x

medium2026-07-13

CVE-2026-52820-Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

kimai/kimai · GHSA-vrr2-g9gh-c3jc

medium2026-07-13

CVE-2026-52819-Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

kimai/kimai · GHSA-4m8q-55qv-9pwp

medium2026-07-13

CVE-2026-49992- Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

kimai/kimai · GHSA-pgcc-vfmc-7cw5