Security advisories

high2026-07-06

CVE-2026-55427-Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

coder/coder · GHSA-mcqq-fqgf-rxwm

high2026-07-06

CVE-2026-55077-Coder: User-admin role can reset owner account password

coder/coder · GHSA-29xf-69gq-m9jx

high2026-07-06

CVE-2026-55075-Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

coder/coder · GHSA-9r87-mvcw-x35f

high2026-07-06

CVE-2026-55076-Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

coder/coder · GHSA-75vm-6w67-gwvp

high2026-07-06

CVE-2026-54640-OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

openremote/openremote · GHSA-7v6w-c3f4-9wpq

high2026-07-06

CVE-2026-54641-OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl

openremote/core · GHSA-xqr9-4wvv-gvch

medium2026-07-06

CVE-2026-53935-CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation

cilium/cilium · GHSA-q6h5-q3q6-f87x

medium2026-07-06

CVE-2026-53624-GoFiber never set HSTS header in helmet middleware due to incorrect protocol check

gofiber/fiber · GHSA-gv83-gqw6-9j2c

high2026-07-06

CVE-2026-54771-Langroid: handle_message() executes user-supplied tool JSON without sender verification

langroid/langroid · GHSA-gjgq-w2m6-wr5q

critical2026-07-06

CVE-2026-54769-Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

langroid/langroid · GHSA-q9p7-wqxg-mrhc

critical2026-07-06

CVE-2026-54760-Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

langroid/langroid · GHSA-6xc5-4r68-67fc

medium2026-07-06

CVE-2026-54637-Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

dragonflyoss/dragonfly · GHSA-chwm-m7g7-685g

low2026-07-06

CVE-2026-53759-Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases

linuxfabrik/monitoring-plugins · GHSA-r35r-fpx2-jgr4

medium2026-07-06

CVE-2026-56384-Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

craftcms/cms · GHSA-x76w-8c62-48mg

critical2026-07-06

CVE-2026-53486-Decompress: Archive extraction can create files and links outside of the target directory

xhmikosr/decompress · GHSA-mp2f-45pm-3cg9

medium2026-07-06

CVE-2026-35366-printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

uutils/coreutils · GHSA-p7h3-7q52-72w8

low2026-07-06

CVE-2026-35362-uucore: safe_traversal TOCTOU protection only enabled on Linux

uutils/coreutils · GHSA-w6xc-g9qj-vp32

medium2026-07-06

CVE-2026-35365-mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)

uutils/coreutils · GHSA-h444-6j9x-p8vh

medium2026-07-06

CVE-2026-35358-cp: -R reads device nodes as streams, destroying device semantics

uutils/coreutils · GHSA-8vrf-r662-2w2v

medium2026-07-06

CVE-2026-35363-rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection

uutils/coreutils · GHSA-89p7-7cq3-hhr2