Security advisories

medium2026-07-02

CVE-2026-45045-GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward

gofiber/fiber · GHSA-gcfq-8gqf-4876

medium2026-07-02

CVE-2026-44332-GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer

gofiber/fiber · GHSA-g5vh-55hw-rxm8

high2026-07-02

CVE-2026-8147-MLflow: trace API endpoints lack proper authorization validators

mlflow/mlflow · GHSA-2cm6-r77w-6g96

medium2026-07-01

OpenClaw MCP SSE redirects could forward Authorization headers

openclaw/openclaw · GHSA-9c3v-684m-579c

high2026-07-01

CVE-2026-50143-Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token

apify/apify-mcp-server · GHSA-6gr2-qh89-hxwm

medium2026-07-01

CVE-2026-50139-goshs: Share-link ?token=… redemption races past download limit

patrickhener/goshs · GHSA-j48m-h7xq-2xpj

critical2026-07-01

CVE-2026-53943-Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

tryghost/ghost · GHSA-62q6-4hv4-vjrw

high2026-07-01

CVE-2026-50138-goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

patrickhener/goshs · GHSA-3whc-qvhv-xqjp

medium2026-07-01

ORAS Go forwards registry credentials across registry redirects

oras-project/oras-go · GHSA-vh4v-2xq2-g5cg

high2026-07-01

CVE-2026-53712-OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms

ongres/scram · GHSA-p9jg-fcr6-3mhf

high2026-07-01

CVE-2026-50163-`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution

oras-project/oras-go · GHSA-fxhp-mv3v-67qp

medium2026-07-01

CVE-2026-50162-oras-go has file store write outside workingDir via symlink traversal

oras-project/oras-go · GHSA-8xwf-rjm4-xvhv

high2026-07-01

CVE-2026-49119- Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks

gradio-app/gradio · GHSA-j36p-7w88-g82j

high2026-07-01

CVE-2026-50151-oras-go blob upload vulnerable to credential forwarding via unvalidated Location header

oras-project/oras-go · GHSA-jxpm-75mh-9fp7

high2026-07-01

CVE-2026-9795-Keycloak has privilege escalation via improper scope mapping enforcement

keycloak/keycloak · GHSA-32h4-44jj-c5vx

low2026-07-01

CVE-2026-48978-oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

oras-project/oras-go · GHSA-xf85-363p-868w

critical2026-07-01

CVE-2026-41052-Rancher has Privilege Escalation from Project Owner to Host

rancher/rancher · GHSA-vx8h-4prv-g744

medium2026-07-01

CVE-2026-48824-Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

axllent/mailpit · GHSA-28pq-6qxg-wg5r

medium2026-07-01

CVE-2026-48819-@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key

hey-api/openapi-ts · GHSA-hhx9-57xq-r5rw

high2026-07-01

CVE-2026-41053-Rancher has over-inclusive team membership expansion in GitHub App authentication provider

rancher/rancher · GHSA-4j6x-2764-m8gh