Security advisories

medium2026-06-26

CVE-2026-50573-pnpm: Unsafe default behavior breaks integrity check

pnpm/pnpm · GHSA-54hh-g5mx-jqcp

high2026-06-26

CVE-2026-47074-ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature bypass

ex-aws/ex_aws_sns · GHSA-8jgf-23q5-x7xx

medium2026-06-26

CVE-2026-50029-js-toml has silent type confusion via falsy-primitive duplicate-key bypass

sunnyadn/js-toml · GHSA-m34p-749j-x6m6

medium2026-06-26

CVE-2026-49349-regclient may leak authentication credentials to external blob stores

regclient/regclient · GHSA-qvqc-4c52-x6qp

low2026-06-26

CVE-2026-48794-Authelia has an Edge Case Access Control Rule Mismatch

authelia/authelia · GHSA-j748-h363-wqj8

critical2026-06-26

Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

nezhahq/nezha · GHSA-q6xx-5vr8-p898

high2026-06-26

Blnk has an API key authorization bypass in owner and scope enforcement

blnkfinance/blnk · GHSA-wcr3-9x4c-f5gj

medium2026-06-26

CVE-2026-49342-YARD static cache reads raw traversal paths before router sanitization

lsegal/yard · GHSA-pxcc-8665-phx8

medium2026-06-26

CVE-2026-49336-@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter

microsoft/kiota-typescript · GHSA-396q-4vc8-28x9

high2026-06-26

CVE-2026-49293-js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

sunnyadn/js-toml · GHSA-wp3c-266w-4qfq

high2026-06-26

SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings

solidinvoice/solidinvoice · GHSA-7vfx-4246-jcfh

high2026-06-26

CVE-2026-49287-Statamic CMS's unsafe method invocation via collection sorting allows data destruction

statamic/cms · GHSA-m92m-r54r-x8r2

medium2026-06-26

CVE-2026-49288-Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources

statamic/cms · GHSA-2497-6pwj-pwg7

medium2026-06-26

CVE-2026-49359-PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option

pontedilana/php-weasyprint · GHSA-x8g9-h984-pc36

low2026-06-26

CVE-2026-49358-PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

pontedilana/php-weasyprint · GHSA-5g9f-cwwg-4p8g

high2026-06-26

CVE-2026-49286-PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

pontedilana/php-weasyprint · GHSA-2fmj-p74r-3wjm

high2026-06-26

CVE-2026-47067-Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes

benoitc/hackney · GHSA-9653-rcfr-5c62

high2026-06-26

CVE-2026-47073-Hackney has unbounded buffer accumulation in WebSocket

benoitc/hackney · GHSA-q8jg-fgj4-fphf

medium2026-06-26

CVE-2026-47072-Hackney has CRLF / header injection in WebSocket upgrade request

benoitc/hackney · GHSA-f9vr-g2g2-x9fg

medium2026-06-26

CVE-2026-47075-Hackney has CR/LF injection in query parameter

benoitc/hackney · GHSA-j9wq-vxxc-94wf