Security advisories

critical2026-06-26

CVE-2026-48797-Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

mcp-tool-shop-org/backpropagate · GHSA-f65r-h4g3-3h9h

medium2026-06-26

nono-py has proxy-only network fallback bypass on older Linux kernels

always-further/nono-py · GHSA-72w7-mf9g-733p

medium2026-06-26

CVE-2026-41262-Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint

fleetdm/fleet · GHSA-gm7f-v959-fr2g

high2026-06-26

Hysteria: http large header with sniff cause server DoS

apernet/hysteria · GHSA-jqc5-2p7q-fqfc

high2026-06-26

Hysteria vulnerable to server crash when max_datagram_frame_size very small

apernet/hysteria · GHSA-qh5x-rfwf-rvfv

high2026-06-26

Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF

apernet/hysteria · GHSA-vgrc-hq28-p3xp

medium2026-06-26

@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths

cdxgen/cdxgen · GHSA-5vwr-qchf-q4pf

high2026-06-26

CVE-2026-48788-Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

umputun/remark42 · GHSA-4c8j-mgm4-qqvp

medium2026-06-26

CVE-2026-48785-Apptainer has incorrect path matching for 'limit container paths' directive

apptainer/apptainer · GHSA-cr2j-534f-mf3g

medium2026-06-26

CVE-2026-48782-pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

pydantic/pydantic-ai · GHSA-cg7w-rg45-pc59

critical2026-06-26

CVE-2026-48769-Incus has an arbitrary file write on its client due to trusted image hash

lxc/incus · GHSA-f6m5-xw2g-xc4x

medium2026-06-26

CVE-2026-48758-@sigstore/core has DSSE payloadType type-binding failure

sigstore/sigstore-js · GHSA-jfc7-64v2-mr8c

low2026-06-26

CVE-2026-48756-Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

lxc/incus · GHSA-xhqx-mgh3-3h7q

critical2026-06-26

CVE-2026-48755-Incus has an argument injection in backup compression algorithm leading to AFW and ACE

lxc/incus · GHSA-v6mj-8pf4-hhw4

low2026-06-26

CVE-2026-48754-Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}

lxc/incus · GHSA-4xg6-52mh-fpw8

critical2026-06-26

CVE-2026-48753-Incus has an arbitrary file write via path traversal in S3 multipart upload

lxc/incus · GHSA-ccjc-4qc3-jxqc

critical2026-06-26

CVE-2026-48752-Incus has arbitrary file read+write on host via templates/ symlink in malicious image

lxc/incus · GHSA-vxp5-584q-c479

high2026-06-26

CVE-2026-56876-extract-zip unvalidated symlink path traversal

max-mapper/extract-zip · GHSA-jmr9-qjv8-65gv

medium2026-06-26

CVE-2026-11779-Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts

payloadcms/payload · GHSA-jg8r-5jh2-v2xj

critical2026-06-26

CVE-2026-48751-Incus has a restricted project bypass leading to arbitrary command execution

lxc/incus · GHSA-48q5-w887-33wv