Security advisories

high2026-06-26

CVE-2026-47077-Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

benoitc/hackney · GHSA-jq4m-q6p2-8gwc

medium2026-06-26

CVE-2026-47070-Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body

benoitc/hackney · GHSA-h73q-4w9q-82h4

medium2026-06-26

CVE-2026-47076-Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host

benoitc/hackney · GHSA-pj7v-xfvx-wmjq

low2026-06-26

CVE-2026-47069-Hackney has CRLF / header injection via unvalidated `domain` and `path` options

benoitc/hackney · GHSA-mp55-p8c9-rfw2

high2026-06-26

CVE-2026-47071-Hackney: `ssl:connect/2` post-handshake upgrade has no timeout

benoitc/hackney · GHSA-gp9c-pm5m-5cxr

high2026-06-26

CVE-2026-47066-Hackney has an infinite loop on non-token byte at start of an Alt-Svc entry

benoitc/hackney · GHSA-6cp8-v795-jr2j

high2026-06-26

CVE-2026-49357-Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication

dtwang/line-desktop-mcp · GHSA-4hf8-5mjm-rfgq

low2026-06-26

CVE-2026-49262-Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

aimeos/pagible · GHSA-mmj8-wcvw-6789

medium2026-06-26

CVE-2026-48995-pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

pnpm/pnpm · GHSA-hg3w-7f8c-63hp

medium2026-06-26

CVE-2026-5223-Cargo crates in third party registries can override the cached source of other crates

rust-lang/cargo · GHSA-jq42-7mfv-hm57

low2026-06-26

CVE-2026-5222-Cargo can be coerced to share credentials between registries

rust-lang/cargo · GHSA-p688-r7jv-fm6f

high2026-06-26

CVE-2026-49260-php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

pontedilana/php-weasyprint · GHSA-f5gc-qxf8-mh9g

high2026-06-26

CVE-2026-49258-Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

juev/nebula-mesh · GHSA-c6v2-3ffm-vcmc

high2026-06-26

phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

thorsten/phpmyfaq · GHSA-985r-q3qp-299h

low2026-06-26

@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url

morganoncode/cardano402 · GHSA-rp72-5v5q-2446

critical2026-06-26

CVE-2026-49257-mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

startreedata/mcp-pinot · GHSA-73cv-556c-w3g6

critical2026-06-26

CVE-2026-49454-Relyra SAML SignatureValue not cryptographically verified -> authentication bypass

sztheory/relyra · GHSA-jv46-xfwm-36j7

high2026-06-26

CVE-2026-49291-mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call

doobidoo/mcp-memory-service · GHSA-2r68-g678-7qr3

critical2026-06-26

CVE-2026-49252-deepstream is vulnerable to prototype pollution

deepstreamio/deepstream.io · GHSA-9v98-6g37-x9g6

medium2026-06-26

Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers

webcomics/dosage · GHSA-75mw-h36v-2jv7