Security advisories

critical2026-07-02

CVE-2026-54617-LaunchServer FileServerHandler has an unauthenticated path traversal issue

gravitlauncher/launcher · GHSA-5g75-477j-2c2f

high2026-07-02

CVE-2026-49284-SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`

simplesamlphp/simplesamlphp · GHSA-q8r6-xj3f-wrrm

high2026-07-02

CVE-2026-52792-Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

xyproto/algernon · GHSA-mm6c-5j6x-hq8m

high2026-07-02

CVE-2026-52834-jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow

tirr-c/jxl-oxide · GHSA-5pmv-rx8r-wmv5

medium2026-07-02

jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow

tirr-c/jxl-oxide · GHSA-66m8-c62j-h6v5

medium2026-07-02

jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)

tirr-c/jxl-oxide · GHSA-2v8p-fqpx-2q3w

low2026-07-02

Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation

kimai/kimai · GHSA-j5mc-p8qg-39j7

high2026-07-02

CVE-2026-2092-Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

keycloak/keycloak · GHSA-794g-x443-36f7

critical2026-07-02

CVE-2026-52830-fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection

alexeyleshchenko/fast-mcp-telegram · GHSA-rxw2-pc8j-vxwm

low2026-07-02

CVE-2026-50268-Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding

steeltoeoss/security-advisories · GHSA-4j9m-h44m-2hv8

medium2026-07-02

CVE-2026-50267-Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

steeltoeoss/security-advisories · GHSA-rxrh-4j9h-xgg9

medium2026-07-02

CVE-2026-50202-Steeltoe's static JWKS cache shared across schemes and never invalidated

steeltoeoss/security-advisories · GHSA-7fqc-p256-7pwj

medium2026-07-02

CVE-2026-50201-Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

steeltoeoss/security-advisories · GHSA-227r-jm2g-7cp4

high2026-07-02

CVE-2026-50200-Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

steeltoeoss/steeltoe · GHSA-q62h-354g-5r85

high2026-07-02

CVE-2026-50196-Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

steeltoeoss/steeltoe · GHSA-j8ph-6fxj-g533

high2026-07-02

CVE-2026-50194-Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

steeltoeoss/steeltoe · GHSA-58f6-6rj2-3v8r

high2026-07-02

CVE-2026-49289-SimpleSAMLphp has Possible DoS via XPath Transform

simplesamlphp/saml2 · GHSA-5cjr-mxj5-wmrx

high2026-07-02

CVE-2026-52829-Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

zcashfoundation/zebra · GHSA-63wg-wjjj-7cp8

high2026-07-02

CVE-2026-49283-SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

simplesamlphp/saml2 · GHSA-6929-8p9f-26jx

high2026-07-02

CVE-2026-52817-Linuxfabrik Monitoring Plugins: Sudoers may be able to obtain privilege escalation via /usr/bin/apt-get arguments

linuxfabrik/monitoring-plugins · GHSA-8w6w-23mq-h8rg