Security advisories

medium2026-07-13

Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

apple/app-store-server-library-python · GHSA-8f6j-263m-g72x

high2026-07-13

json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS

mangiucugna/json_repair · GHSA-xf7x-x43h-rpqh

critical2026-07-13

CVE-2026-47677-FacturaScripts: Account takeover of any 2FA-enabled user

neorazorx/facturascripts · GHSA-c67f-gmxw-mj93

high2026-07-13

CVE-2026-49970-Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()

plank/laravel-mediable · GHSA-xv8g-76mx-2rxc

high2026-07-13

DIRAC: SQL injection and lack of access control in PilotManager service

diracgrid/dirac · GHSA-7xw9-549r-8jrc

high2026-07-13

CVE-2026-61668-DIRAC: Pilot code downloaded over unverified HTTPS connection

diracgrid/dirac · GHSA-vg99-gr89-qhw9

critical2026-07-13

CVE-2026-61667-DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

diracgrid/dirac · GHSA-m4m7-4cw8-62j6

high2026-07-13

CVE-2026-59955-Apollo ConfigService access key authentication bypass via raw config file appId parsing

apolloconfig/apollo · GHSA-h4pc-58cc-hc95

high2026-07-13

CVE-2026-59954-Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching

apolloconfig/apollo · GHSA-4w3q-qpfq-v992

high2026-07-13

CVE-2026-55372-NukeViet: Pre-authentication SSRF via X-Forwarded-Host

nukeviet/nukeviet · GHSA-4chg-4752-w88r

high2026-07-13

CVE-2026-54065-NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function

nukeviet/nukeviet · GHSA-c9xg-64p9-f2jj

high2026-07-13

CVE-2026-54064-NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module

nukeviet/nukeviet · GHSA-465g-4q99-5x86

high2026-07-13

CVE-2026-49259-NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

nukeviet/nukeviet · GHSA-w2w5-w2pw-r929

high2026-07-13

CVE-2026-48118-NukeViet: Unauthenticated Reflected XSS in Comment Module

nukeviet/nukeviet · GHSA-mxpf-qgg6-v3ff

critical2026-07-13

CVE-2026-45579-DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input

diracgrid/dirac · GHSA-9jpv-c7p4-997x

medium2026-07-13

CVE-2026-45573-Decidim: Push subscriptions can be abused for server-side requests

decidim/decidim · GHSA-2g9c-vf8h-prxx

medium2026-07-13

CVE-2026-45572-Decidim: HTML content blocks allow stored script execution

decidim/decidim · GHSA-533c-2vh9-4r86

medium2026-07-13

CVE-2026-45415-Decidim: CSV census record endpoints improper authorization

decidim/decidim · GHSA-q79h-67vx-m9xg

high2026-07-13

CVE-2026-45414-Decidim: JWT-backed authentication can be replayed across organizations

decidim/decidim · GHSA-r3v7-5x4c-c69q

high2026-07-13

CVE-2026-45378-Decidim: Verification documents can be downloaded through reusable links

decidim/decidim · GHSA-3mvf-82qp-8qh5