Security advisories

medium2026-07-02

CVE-2026-50290-@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

asymmetric-effort/specifyjs · GHSA-93q6-wwjh-jc6h

medium2026-07-02

@asymmetric-effort/specifyjs: No redirect target validation in secureFetch

asymmetric-effort/specifyjs · GHSA-j5qp-p44g-2m49

medium2026-07-02

@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction

asymmetric-effort/specifyjs · GHSA-2944-57xv-2682

medium2026-07-02

@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)

asymmetric-effort/specifyjs · GHSA-xw57-23p8-9wc5

medium2026-07-02

@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state

asymmetric-effort/specifyjs · GHSA-qcr8-x557-7cp3

medium2026-07-02

@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection

asymmetric-effort/specifyjs · GHSA-5c7w-4wm3-85vw

high2026-07-02

CVE-2026-50288-@asymmetric-effort/specifyjs: URL parse failure silently allows request

asymmetric-effort/specifyjs · GHSA-8882-frvv-92w4

high2026-07-02

CVE-2026-50284-Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

craftcms/cms · GHSA-7h62-6v23-v8fm

medium2026-07-02

CVE-2026-50283-Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

craftcms/cms · GHSA-qh45-9g5p-m2v4

medium2026-07-02

CVE-2026-50280-Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

craftcms/cms · GHSA-43cq-c2gq-pfpw

high2026-07-02

CVE-2026-50279-Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

craftcms/cms · GHSA-qq2c-2q8j-jh27

high2026-07-02

CVE-2026-44454-Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

coder/coder · GHSA-m3cr-vc2j-pm27

high2026-07-02

CVE-2026-52854-mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function

professionalwiki/maps · GHSA-4h7g-5542-v3fc

high2026-07-02

CVE-2026-52726-Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload

jelmer/dulwich · GHSA-gfhv-vqv2-4544

high2026-07-02

CVE-2026-50180-Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

langroid/langroid · GHSA-pmch-g965-grmr

high2026-07-02

CVE-2026-50181-Langroid: Path traversal in the file tools allows read/write outside configured current directory

langroid/langroid · GHSA-fg23-3346-88f5

medium2026-07-02

CVE-2026-50192-Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect

kerberos-io/agent · GHSA-h5gx-45rj-2h5j

high2026-07-02

OpenClaw: Native command authorization could skip owner-command enforcement

openclaw/openclaw · GHSA-p73f-w79w-jqr5

high2026-07-02

CVE-2026-53836-OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

openclaw/openclaw · GHSA-j472-gf56-x589

high2026-07-02

OpenClaw: Trusted retry endpoint checks could match hostname prefixes

openclaw/openclaw · GHSA-77q5-rr5v-x43q