Security advisories

medium2026-07-09

CVE-2026-53769-Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

avo-hq/avo · GHSA-pqpw-cvm4-8mv9

high2026-07-09

CVE-2026-53932-laravel-backup-restore has an OS Command Injection during database restore

stefanzweifel/laravel-backup-restore · GHSA-w9mx-xmg4-gc4r

medium2026-07-09

CVE-2026-53602-nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate

forgekeep/nebula-mesh · GHSA-339v-266x-79xr

medium2026-07-09

Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data

jsonbored/gittensory · GHSA-382c-vx95-w3p5

medium2026-07-09

CVE-2026-53760-Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

admidio/admidio · GHSA-hm42-q32m-vj4f

high2026-07-09

CVE-2026-56382-Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

craftcms/cms · GHSA-86vw-x4ww-x467

low2026-07-09

CVE-2026-56394-Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

craftcms/cms · GHSA-c43v-4cr8-6mvp

high2026-07-09

CVE-2026-53727-Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`

premailer/css_parser · GHSA-9pmc-p236-855h

high2026-07-09

CVE-2026-49485-org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

hapifhir/org.hl7.fhir.core · GHSA-7cmj-v6x8-frvv

medium2026-07-09

CVE-2026-53720-pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small

jetperch/pymonocypher · GHSA-8f95-v3jq-cj86

high2026-07-09

CVE-2026-50553-Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

enchant97/note-mark · GHSA-rqrh-8wpv-x7hh

medium2026-07-09

CVE-2026-50554-Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books

enchant97/note-mark · GHSA-588f-fvcv-xhvf

high2026-07-09

CVE-2026-49477-Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

facelessuser/soupsieve · GHSA-836r-79rf-4m37

high2026-07-09

CVE-2026-49476-Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

facelessuser/soupsieve · GHSA-2wc2-fm75-p42x

high2026-07-09

Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths

fadelabs/phantom · GHSA-52vm-mxx8-f227

medium2026-07-09

Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers

micronaut-projects/micronaut-core · GHSA-q6gh-6v2r-hjv3

high2026-07-09

Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS

micronaut-projects/micronaut-core · GHSA-387m-935m-c4vw

medium2026-07-09

CVE-2026-48987-pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

pyload/pyload · GHSA-c2f9-4mc8-j656

medium2026-07-09

CVE-2026-48737-pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

pyload/pyload · GHSA-m5x5-28jr-gpjj

high2026-07-08

CVE-2026-49471-Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

oraios/serena · GHSA-37h2-6p4f-mp3q