Security advisories

high2026-07-08

CVE-2026-49464-NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

nl-portal/nl-portal-backend-libraries · GHSA-6h3c-r723-7fx3

medium2026-07-08

CVE-2026-49463-NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

nl-portal/nl-portal-backend-libraries · GHSA-qpm9-h556-mwxm

low2026-07-08

CVE-2026-49456-Waku has an Open Redirect via `unstable_redirect` Helper

wakujs/waku · GHSA-43fc-v873-qw85

medium2026-07-08

CVE-2026-49455-Waku: Cross-Origin CSRF on RSC Server Action Dispatch

wakujs/waku · GHSA-75w3-gmqx-993q

critical2026-07-08

CVE-2026-53649-Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

bishopfox/joro · GHSA-xqhv-chqm-fhcc

medium2026-07-08

OneRingBuf has a Use After Free Vulnerability

skilvingr/rust-oneringbuf · GHSA-q95x-7g78-rccv

medium2026-07-08

CVE-2026-49833-DSpace: Path Traversal is possible through LDN message generation

dspace/dspace · GHSA-9qm4-rh6w-pq5x

medium2026-07-08

CVE-2026-49830-DSpace: ORE resource URI does not validate scheme for non-web resources

dspace/dspace · GHSA-c827-pw3m-67w7

medium2026-07-08

CVE-2026-49831-DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output path

dspace/dspace · GHSA-v66x-68f2-pxf5

high2026-07-08

CVE-2026-49832-DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN

dspace/dspace · GHSA-9x82-rm84-c6x7

medium2026-07-08

Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler

0xballpoint/trapster-community · GHSA-mxwc-wh95-pw4g

medium2026-07-08

CVE-2026-53634-Sharp Missing Authorization Check in Quick Creation Command Endpoints

code16/sharp · GHSA-vmwx-m75v-qvch

critical2026-07-08

CVE-2026-52831-Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

nuclio/nuclio · GHSA-v5px-423j-pf7p

medium2026-07-08

CVE-2026-53600-async-tar PAX extension-header desync enables tar entry/content smuggling

dignifiedquire/async-tar · GHSA-35rm-7j9c-2f7m

high2026-07-08

CVE-2026-50197-Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests

zalando/skipper · GHSA-659f-rgp5-w4wf

high2026-07-08

CVE-2026-49825-`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

fedora-python/lxml_html_clean · GHSA-4jhm-jv67-739f

medium2026-07-07

CVE-2026-50127-Weblate SSRF: outbound URL guard misses some private ranges

weblateorg/weblate · GHSA-vmfc-9982-2m45

medium2026-07-07

CVE-2026-53508-oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

oasdiff/oasdiff · GHSA-2jcc-mxv7-p3f9

medium2026-07-07

CVE-2026-53572-KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping

kedacore/keda · GHSA-6w3m-4hhp-775q

medium2026-07-07

Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion

pallets-eco/flask-security · GHSA-f66q-9rf6-8795