Security advisories

high2026-06-30

CVE-2026-49473-@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

cedar-policy/authorization-for-expressjs · GHSA-g4w6-vmgf-xqvx

high2026-06-30

Kahi has privilege-drop and socket/log permission issues

kahiteam/kahi · GHSA-55f6-4pr5-c7m5

high2026-06-30

CVE-2026-47198-Paymenter has URL parameter injection that bypasses paid plan limits at checkout

paymenter/paymenter · GHSA-5q4q-834j-g8g4

medium2026-06-30

CVE-2023-46118-RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API

rabbitmq/rabbitmq-server · GHSA-w6cq-9cf4-gqpg

medium2026-06-30

CVE-2022-31008-RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins

rabbitmq/rabbitmq-server · GHSA-v9gv-xp36-jgj8

high2026-06-30

CVE-2026-49451-Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

microsoft/openapi.net · GHSA-v5pm-xwqc-g5wc

medium2026-06-30

CVE-2026-53433-fzf vulnerable to denial of service through quadratic HTTP request-body accumulation

junegunn/fzf · GHSA-mvmf-94v6-879g

high2026-06-29

CVE-2026-44840-Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

dgraph-io/dgraph · GHSA-q2m9-6jp9-c6mc

critical2026-06-29

CVE-2026-11720-MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints

googleapis/mcp-toolbox · GHSA-vwxw-jrg6-9jxv

medium2026-06-29

CVE-2026-48717-OpenAM OAuth Authorization Bypass via PKCE Challenge

openidentityplatform/openam · GHSA-4v2w-2wqp-mc85

high2026-06-29

CVE-2026-47426-OpenAM OAuth Client Impersonation via JWKS Resolver Cache

openidentityplatform/openam · GHSA-f2cx-463q-7m2c

high2026-06-29

CVE-2026-47424-OpenAM Authenticated RCE via Groovy Sandbox Escape

openidentityplatform/openam · GHSA-69j4-qvqr-hpw3

high2026-06-27

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

pnpm/pnpm · GHSA-qrv3-253h-g69c

high2026-06-27

pnpm: `patch-remove` could delete project-selected files outside the patches directory

pnpm/pnpm · GHSA-72r4-9c5j-mj57

high2026-06-27

pnpm: Hoisted install imports lockfile alias outside node_modules

pnpm/pnpm · GHSA-fr4h-3cph-29xv

medium2026-06-26

Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API

nezhahq/nezha · GHSA-ww5p-j6cj-6mqq

high2026-06-26

CVE-2026-55700-pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

pnpm/pnpm · GHSA-v23m-ccfg-pq9h

medium2026-06-26

CVE-2026-55699-pnpm: Reserved bin name deletes PNPM_HOME during global remove

pnpm/pnpm · GHSA-4gxm-v5v7-fqc4

high2026-06-26

CVE-2026-55698-pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

pnpm/pnpm · GHSA-w466-c33r-3gjp

high2026-06-26

CVE-2026-49338-Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

sentriz/gonic · GHSA-hmgp-w9jm-vp95