Security Advisories

medium2026-10-23

Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type

bytecodealliance/wasmtime · GHSA-9pvw-hwfg-92h5 · CVE-2026-115892

critical2026-10-23

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

bytecodealliance/wasmtime · GHSA-897f-g5gm-fmxm · CVE-2026-115889

medium2026-10-23

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

tox-dev/filelock · GHSA-2g95-wg33-c5x2 · CVE-2026-112906

medium2026-10-23

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

tox-dev/filelock · GHSA-crv4-6mhj-j5jh · CVE-2026-112914

high2026-10-23

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

tox-dev/filelock · GHSA-v4x8-3wr5-3wq8 · CVE-2026-112940

low2026-10-23

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

fallow-rs/fallow · GHSA-h4fr-cmh5-qr62

low2026-10-23

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

fallow-rs/fallow · GHSA-jfwm-3p3c-6hx5 · CVE-2026-115569

critical2026-10-23

Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

python-pillow/pillow · GHSA-5x8w-8jj5-q52h · CVE-2026-112398

high2026-10-23

postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

postalsys/postal-mime · GHSA-f2hq-32vh-53cc

medium2026-10-23

Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

python-pillow/pillow · GHSA-654x-cwwv-5j9c · CVE-2026-114501

medium2026-10-23

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

nodemailer/nodemailer · GHSA-8c8m-p3m8-cjg8

medium2026-10-23

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

nodemailer/nodemailer · GHSA-m943-m63m-w62w

medium2026-10-23

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

nodemailer/nodemailer · GHSA-85x2-q946-cp5h

critical2026-10-23

Laravel TokenGuard authentication bypass through non-string API credentials

laravel/framework · GHSA-f9x3-7vq9-cph6 · CVE-2026-114509

medium2026-10-23

Laravel relationship inclusion can trigger unauthorized data destruction

laravel/framework · GHSA-5wcm-3v2w-8362 · CVE-2026-114508

low2026-10-23

setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

pypa/setuptools · GHSA-xmj3-9gf7-h52w

medium2026-10-23

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

fastify/fast-uri · GHSA-w74x-v6f9-j3xg · CVE-2026-110306

low2026-10-23

fast-uri vulnerable to improper path equivalence in relative reference normalization

fastify/fast-uri · GHSA-xhq7-xmqj-769h · CVE-2026-110095

medium2026-10-23

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

fastify/fast-uri · GHSA-wjr9-j795-jxcr · CVE-2026-110180

low2026-10-23

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

fastify/fast-uri · GHSA-333x-w4r6-6crp · CVE-2026-110725