Security advisories

medium2026-06-26

Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)

scriban/scriban · GHSA-6q7j-xr26-3h2c

medium2026-06-26

Scriban: array * int (ScriptArray<T>.TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of GHSA-24c8-4792-22hx

scriban/scriban · GHSA-q6rr-fm2g-g5x8

low2026-06-26

nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction

juev/nebula-mesh · GHSA-v2jf-442r-6mjh

medium2026-06-26

WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs

web-auth/webauthn-framework · GHSA-q683-8468-r6h6

medium2026-06-26

CVE-2026-48820-CakePHP: View::element() is missing a path containment check

cakephp/cakephp · GHSA-wpvj-hjcr-h3p2

medium2026-06-26

CVE-2026-48990-joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

authlib/joserfc · GHSA-wphv-vfrh-23q5

high2026-06-26

better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server

rigby-foundation/betterhelperjs · GHSA-3p34-w4f6-5xh2

high2026-06-26

CVE-2026-48979-PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling

php-standard-library/php-standard-library · GHSA-pw9p-jvrm-f7rm

high2026-06-26

Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

julianhille/muhammarajs · GHSA-fhp4-pr5j-46m5

medium2026-06-26

Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system

pterodactyl/panel · GHSA-j7f5-gfqm-pcx3

medium2026-06-26

Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container

pterodactyl/wings · GHSA-rhq6-9rgh-v45c

high2026-06-26

CVE-2026-48813-Flawfinder output manipulation via untrusted filenames and source text

david-a-wheeler/flawfinder · GHSA-4c3c-r6p8-c863

high2026-06-26

CVE-2026-48804-python-socketio: Binary attachment accumulation can cause denial of service

miguelgrinberg/python-socketio · GHSA-5w7q-77mv-v69f

high2026-06-26

CVE-2026-48802-python-engineio has unbound thread allocation that can cause denial of service

miguelgrinberg/python-engineio · GHSA-cgwc-pv48-fhj5

critical2026-06-26

semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin

aurelio-labs/semantic-router · GHSA-98x5-vq43-vc5p

high2026-06-26

CVE-2026-48809-python-engineio has possible denial of service due to maximum payload size sometimes not being enforced

miguelgrinberg/python-engineio · GHSA-m9gh-vj53-gvh9

high2026-06-26

CVE-2026-48801-LinkifyIt#match scan loop has quadratic algorithmic complexity

markdown-it/linkify-it · GHSA-22p9-wv53-3rq4

medium2026-06-26

CVE-2026-48790-turso-cli persists Turso platform JWT with world-readable (0o644) file permissions

tursodatabase/turso-cli · GHSA-57f6-pvx8-hwj6

medium2026-06-26

nono-py's policy JSON accepts unknown security fields

always-further/nono-py · GHSA-m8j6-rc5x-wv36

medium2026-06-26

nono-py vulnerable to authorization bypass / policy confusion

always-further/nono-py · GHSA-9j7f-3r4p-pwh6