Security advisories

high2026-07-10

CVE-2026-76913-NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)

notrinos/notrinoserp · GHSA-qv4m-m73m-8hj7

high2026-07-10

CVE-2026-54071-BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

funstory-ai/babeldoc · GHSA-m8gf-v64p-gfmg

critical2026-07-10

CVE-2026-54088-File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

filebrowser/filebrowser · GHSA-m93h-4hw7-5qcm

medium2026-07-10

CVE-2026-54136-Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

windmill-labs/windmill · GHSA-2ppx-66jv-wpw5

high2026-07-10

CVE-2026-54070-SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

siyuan-note/siyuan · GHSA-w7cg-whh7-xp28

critical2026-07-10

CVE-2026-54089-File Browser: Authentication Bypass via Proxy Auth Header Forgery

filebrowser/filebrowser · GHSA-xqp3-jq6g-x3qm

critical2026-07-10

CVE-2026-54069-SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

siyuan-note/siyuan · GHSA-hvr9-72v2-fff3

medium2026-07-10

CVE-2026-54068-SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

siyuan-note/siyuan · GHSA-gcm7-57gf-953c

medium2026-07-10

CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources

samsung/credsweeper · GHSA-9mqm-qcwf-5qhg

high2026-07-10

CVE-2026-54063-Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)

qax-os/excelize · GHSA-h69g-9hx6-f3v4

critical2026-07-10

CVE-2026-54072-Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

authorizerdev/authorizer · GHSA-h29v-hj44-q8cv

critical2026-07-10

CVE-2026-54067-SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

siyuan-note/siyuan · GHSA-mvjr-vv3c-w4qv

high2026-07-10

CVE-2026-54066-SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

siyuan-note/siyuan · GHSA-p4m3-mgmm-c664

high2026-07-10

CVE-2026-39244-adm-zip: Crafted ZIP file triggers 4GB memory allocation

cthackers/adm-zip · GHSA-xcpc-8h2w-3j85

medium2026-07-10

MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)

sooperset/mcp-atlassian · GHSA-489g-7rxv-6c8q

medium2026-07-10

CVE-2026-49977-tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies

amauric/tarteaucitron.js · GHSA-jxj7-g6gm-49j7

high2026-07-10

CVE-2026-49866-libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

libp2p/js-libp2p · GHSA-cwc9-cp4j-mcvv

medium2026-07-10

CVE-2026-49865-Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

kimai/kimai · GHSA-pj8j-p4g4-4vw8

medium2026-07-10

CVE-2026-5078-morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

expressjs/morgan · GHSA-4vj7-5mj6-jm8m

medium2026-07-10

CVE-2026-49858-API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

api-platform/core · GHSA-pjhx-3c3w-9v23