Security advisories

medium2026-07-13

CVE-2026-45377-Decidim: Private exports can be downloaded through reusable links

decidim/decidim · GHSA-767h-63j4-5226

medium2026-07-13

CVE-2026-45376-Decidim: Admin user search allows SQL injection through similarity-based sorting

decidim/decidim · GHSA-jvqq-cvh4-xm37

medium2026-07-13

CVE-2026-45330-Decidim: Verification admins can access supplied IDs from other organizations

decidim/decidim · GHSA-86fh-w43w-338c

medium2026-07-13

CVE-2026-45086-Decidim: Forms admin question editor lacks authorization

decidim/decidim · GHSA-vq6j-hj8w-7v39

medium2026-07-13

CVE-2025-32781-Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center

apolloconfig/apollo · GHSA-jxpj-9j24-w337

medium2026-07-13

CVE-2024-27091-GeoNode: Stored XSS to full account takeover

geonode/geonode · GHSA-rwcv-whm8-fmxm

medium2026-07-13

CVE-2026-15529-PyOD persistence.load deserializes untrusted artifacts before validation

yzhao062/pyod · GHSA-997v-r4v7-9f3g

medium2026-07-11

CVE-2026-49844-Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization

apache/logging-log4j2 · GHSA-qv9r-c865-cp47

critical2026-07-10

TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation

almeidapaulopt/tsdproxy · GHSA-g936-7jqj-mwv8

high2026-07-10

CVE-2026-54174-melange: Incomplete package integrity verification allows data section substitution

chainguard-dev/melange · GHSA-fpg8-7664-jc5q

critical2026-07-10

CVE-2026-61459-mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

flux159/mcp-server-kubernetes · GHSA-wmg3-h8mf-wgvr

medium2026-07-10

CVE-2026-54171-Excon does not redact additional sensitive/risky headers when following redirects

excon/excon · GHSA-48rx-c7pg-q66r

high2026-07-10

Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset

schubydoo/clauster · GHSA-h4g2-xfmw-q2c9

medium2026-07-10

CVE-2026-54163-Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input

github/secure_headers · GHSA-rqq5-2gf9-4w4q

critical2026-07-10

CVE-2026-50551-SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

siyuan-note/siyuan · GHSA-56mp-4f3v-fgj2

critical2026-07-10

CVE-2026-54159-prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

prestashop/ps_facetedsearch · GHSA-m5f5-28qr-9g9r

critical2026-07-10

CVE-2026-54158-SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

siyuan-note/siyuan · GHSA-5xfx-xj4h-5p7r

high2026-07-10

CVE-2026-73498-mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

sooperset/mcp-atlassian · GHSA-g5r6-gv6m-f5jv

high2026-07-10

mcp-atlassian: Arbitrary server-side file read via attachment upload

sooperset/mcp-atlassian · GHSA-wm45-qh3g-v83f

high2026-07-10

SafeInstall agent guard shell parsing can miss raw package execution

mickdownunder/safeinstall · GHSA-xrmc-c5cg-rv7x