Security advisories

medium2026-07-07

@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators

better-auth/better-auth · GHSA-p2fr-6hmx-4528

critical2026-07-07

CVE-2026-53512-Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

better-auth/better-auth · GHSA-pw9m-5jxm-xr6h

low2026-07-07

netfoil: Attacker controlled data written to logs

tinfoil-factory/netfoil · GHSA-7856-g3gv-9wq8

low2026-07-07

netfoil has a resource leak in LRU cache

tinfoil-factory/netfoil · GHSA-3g4q-2f67-2gvh

medium2026-07-07

netfoil has a domain name filter bypass via multiple questions

tinfoil-factory/netfoil · GHSA-59qp-cfj3-rp64

high2026-07-07

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

uutils/coreutils · GHSA-fqf6-gxhh-2xhw

medium2026-07-07

CVE-2026-53509-@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

ondata/ckan-mcp-server · GHSA-g84h-j7jj-x32p

medium2026-07-07

CVE-2026-34225-Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

open-webui/open-webui · GHSA-jgx9-jr5x-mvpv

high2026-07-07

CVE-2026-26193-Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

open-webui/open-webui · GHSA-vjm7-m4xh-7wrc

high2026-07-07

CVE-2026-26192-Open WebUI vulnerable to Stored XSS via iFrame in citations model

open-webui/open-webui · GHSA-xc8p-9rr6-97r2

high2026-07-07

CVE-2025-46719-Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions

open-webui/open-webui · GHSA-9f4f-jv96-8766

medium2026-07-07

CVE-2025-46571-Open WebUI allows limited stored XSS vila uploaded html file

open-webui/open-webui · GHSA-8gh5-qqh8-hq3x

medium2026-07-07

CVE-2026-53878-Django: DomainNameValidator permits newline characters that may enable HTTP header injection

django/django · GHSA-8qcx-xf44-272x

low2026-07-07

CVE-2026-48588-Django: cache middleware may expose private responses when unrelated request cookies are present

django/django · GHSA-3h9f-r86x-qvjx

medium2026-07-07

CVE-2026-45016-EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose

egroupware/egroupware · GHSA-c8m7-r2jv-rw63

medium2026-07-07

CVE-2026-44512-ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

onnx/onnx · GHSA-hwpq-hmq9-wj77

medium2026-07-07

CVE-2026-44342-New API is vulnerable to CSRF through user email binding

quantumnous/new-api · GHSA-26v7-h57m-gh9m

high2026-07-07

CVE-2026-40187-EGroupware has Authenticated RCE via Malicious eTemplate Upload

egroupware/egroupware · GHSA-8737-2x9g-xjj7

high2026-07-07

CVE-2026-34151-XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+

xwiki/xwiki-platform · GHSA-qj4x-9g63-25g6

high2026-07-07

CVE-2026-33655-New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs

quantumnous/new-api · GHSA-6qcr-qxgr-m7fv