Security advisories

high2026-06-26

CVE-2026-49339-gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists

sentriz/gonic · GHSA-2fp4-5v5c-4448

high2026-06-26

CVE-2026-49340-gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host

sentriz/gonic · GHSA-4gxv-p5g5-j7w7

high2026-06-26

CVE-2026-55697-pnpm: Repository-controlled configDependencies can select a pacquet native install engine

pnpm/pnpm · GHSA-gj8w-mvpf-x27x

high2026-06-26

CVE-2026-55487-pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

pnpm/pnpm · GHSA-5wx6-mg75-v57r

medium2026-06-26

CVE-2026-55180-pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

pnpm/pnpm · GHSA-3qhv-2rgh-x77r

medium2026-06-26

CVE-2026-53465-ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

imagemagick/imagemagick · GHSA-44cp-c3ww-9rv5

medium2026-06-26

CVE-2026-53464-ImageMagick: Memory Leak in wand option parser when providing invalid arguments

imagemagick/imagemagick · GHSA-j989-f892-2335

low2026-06-26

CVE-2026-54244-Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors

statamic/cms · GHSA-7mqq-4v55-88gh

medium2026-06-26

CVE-2026-53523-Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

nezhahq/nezha · GHSA-9rc6-8cjv-rcvx

medium2026-06-26

CVE-2026-53522-Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS

nezhahq/nezha · GHSA-jg62-j5h6-8mpq

medium2026-06-26

CVE-2026-54243-Statamic Vulnerable to CSV formula injection in form submission exports

statamic/cms · GHSA-h77m-qrj7-jxcw

medium2026-06-26

CVE-2026-54242-Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)

statamic/cms · GHSA-v5c4-wcpj-x73m

critical2026-06-26

CVE-2026-53519-Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

nezhahq/nezha · GHSA-5c25-7vpj-9mqh

medium2026-06-26

CVE-2026-53521-Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context

nezhahq/nezha · GHSA-39g2-8x68-pmx8

medium2026-06-26

CVE-2026-53520-Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

nezhahq/nezha · GHSA-x6fg-52vr-hj4w

high2026-06-26

CVE-2026-50015-pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

pnpm/pnpm · GHSA-rxhj-4m44-96r4

medium2026-06-26

CVE-2026-50017-pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

pnpm/pnpm · GHSA-cjhr-43r9-cfmw

high2026-06-26

CVE-2026-50016-pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

pnpm/pnpm · GHSA-hwx4-2j3j-g496

medium2026-06-26

CVE-2026-50014-pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

pnpm/pnpm · GHSA-p4xf-rf54-rj3x

medium2026-06-26

CVE-2026-50021-pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field

pnpm/pnpm · GHSA-q6j5-fjx5-2mc3