Security advisories

high2026-07-02

CVE-2026-52829-Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

zcashfoundation/zebra · GHSA-63wg-wjjj-7cp8

high2026-07-02

CVE-2026-49283-SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

simplesamlphp/saml2 · GHSA-6929-8p9f-26jx

high2026-07-02

CVE-2026-52817-Linuxfabrik Monitoring Plugins: Sudoers may be able to obtain privilege escalation via /usr/bin/apt-get arguments

linuxfabrik/monitoring-plugins · GHSA-8w6w-23mq-h8rg

medium2026-07-02

@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation

asymmetric-effort/nogginlessdom · GHSA-x4hg-hfwf-p9mw

high2026-07-02

@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write

asymmetric-effort/nogginlessdom · GHSA-322x-v876-g883

critical2026-07-02

CVE-2026-59800-9router: Missing Authorization and OS Command Injection

decolua/9router · GHSA-g6g7-pvmx-m74p

medium2026-07-02

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

nuxt/ui · GHSA-gj2h-2fpw-fhv9

high2026-07-02

CVE-2026-52746-jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion

jsonata-js/jsonata · GHSA-86vw-mfpg-wwv9

medium2026-07-02

CVE-2026-52734-zebrad has unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention

zcashfoundation/zebra · GHSA-65jj-fmw8-468q

medium2026-07-02

CVE-2026-52733-zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip

zcashfoundation/zebra · GHSA-2gf8-q9rr-jq3h

high2026-07-02

CVE-2026-50282-Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

craftcms/cms · GHSA-3w32-23wj-rxg3

high2026-07-02

CVE-2026-50281-Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

craftcms/cms · GHSA-x5m4-g2cq-52pq

medium2026-07-02

CVE-2026-9811-Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector

mautic/mautic · GHSA-5hvg-w58j-545m

high2026-07-02

CVE-2026-9809-Mautic has Stored Cross-Site Scripting (XSS) in Projects Component

mautic/mautic · GHSA-7h65-whp7-rgqf

high2026-07-02

CVE-2026-9808-Mautic has an Authorization Bypass in API v2 Endpoints

mautic/mautic · GHSA-2jrw-c95w-h43g

critical2026-07-02

CVE-2026-9559-Mautic vulnerable to Path Traversal via Campaign Import

mautic/mautic · GHSA-6r9h-4h75-7q4x

critical2026-07-02

CVE-2026-9558-Mautic has Server-Side Template Injection (SSTI) in Theme Templates

mautic/mautic · GHSA-9fx4-7cmj-47vg

medium2026-07-02

CVE-2026-9557-Mautic Focus component Vulnerable to SSRF

mautic/mautic · GHSA-jmv8-8j9j-rcpc

medium2026-07-02

CVE-2026-52739-Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection

zcashfoundation/zebra · GHSA-hhm7-qrv5-h4r6

medium2026-07-02

CVE-2026-52738-Zebra: Finalized address balance credit-first overflow on consensus-valid blocks

zcashfoundation/zebra · GHSA-w834-cf6p-9m9w