Security advisories

medium2026-07-10

CVE-2026-39243-decompress allows arbitrary hardlink creation during archive extraction

kevva/decompress · GHSA-jwp9-9v96-94mx

low2026-07-10

CVE-2026-48598-Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values

elixir-tesla/tesla · GHSA-28jh-g32x-v9v4

high2026-07-10

CVE-2026-48597-Tesla vulnerable to atom exhaustion via untrusted URL scheme

elixir-tesla/tesla · GHSA-h74c-q9j7-mpcm

high2026-07-10

CVE-2026-48595-Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering

elixir-tesla/tesla · GHSA-9m9w-gxf7-rh8m

high2026-07-10

CVE-2026-48594-Tesla has decompression bomb on response body

elixir-tesla/tesla · GHSA-mc85-72gr-vm9f

low2026-07-10

CVE-2026-48596-Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`

elixir-tesla/tesla · GHSA-q7jx-v53g-848w

high2026-07-09

CVE-2026-49851- Mistune: Potential DoS via quadratic-time parsing in parse_link_text

lepture/mistune · GHSA-qcq2-496w-v96p

medium2026-07-09

CVE-2026-49838-GoBGP confederation validation panics on empty AS_PATH attribute

osrg/gobgp · GHSA-frrj-87jh-2772

medium2026-07-09

CVE-2026-49837-GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

osrg/gobgp · GHSA-gjrg-jjr3-56cm

medium2026-07-09

CVE-2026-49836-psd-tools vulnerable to arbitrary file write via smart-object filename

psd-tools/psd-tools · GHSA-2rmg-vrx8-9j2f

medium2026-07-09

CVE-2026-49834-sigstore-go has a multi-log threshold bypass via single compromised log

sigstore/sigstore-go · GHSA-9vcr-p3rj-q5q6

medium2026-07-09

CVE-2026-53956-Rattler vulnerable to package cache path traversal via conda package build string

conda/rattler · GHSA-h672-p7h7-97v9

medium2026-07-09

CVE-2026-55252-OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect

openrundev/openrun · GHSA-h5g6-xmh4-hc37

high2026-07-09

CVE-2026-48862-mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

elixir-mint/mint · GHSA-g586-ccqf-7x4r

high2026-07-09

CVE-2026-49754-mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)

elixir-mint/mint · GHSA-2p26-p43x-fhp8

medium2026-07-09

CVE-2026-49753-mint: Content-Length header accepts non-RFC "+" sign prefix

elixir-mint/mint · GHSA-mjqx-c6f6-7rc2

low2026-07-09

CVE-2026-48861-mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`

elixir-mint/mint · GHSA-2pg6-44cx-c49v

medium2026-07-09

CVE-2026-54651-pypdf: Possible infinite loop when processing threads/articles in writer

py-pdf/pypdf · GHSA-g9xf-7f8q-9mcj

medium2026-07-09

CVE-2026-53639-Sylius: IDOR on Shop Payment Request API endpoints

sylius/sylius · GHSA-mr9r-h354-966r

medium2026-07-09

CVE-2026-53638-Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

sylius/sylius · GHSA-6955-hrm5-c4qp