Security advisories

high2026-06-25

CVE-2026-48506-MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

messagepack-csharp/messagepack-csharp · GHSA-vh6j-jc39-fggf

high2026-06-25

CVE-2026-48505-Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission

filamentphp/filament · GHSA-mc5j-f6wx-h9qh

medium2026-06-25

CVE-2026-48504-opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation

open-telemetry/opentelemetry-rust · GHSA-w9wp-h8wv-79jx

high2026-06-25

CVE-2026-48502-MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

messagepack-csharp/messagepack-csharp · GHSA-382j-8mxh-c7x2

high2026-06-25

CVE-2026-9291-amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()

amazon-braket/amazon-braket-sdk-python · GHSA-g697-2xrc-gc46

medium2026-06-25

CVE-2026-48776-LangGraph SDK has unsafe URL path construction

langchain-ai/langgraph · GHSA-w39p-vh2g-g8g5

medium2026-06-25

CVE-2026-48775-LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

langchain-ai/langgraph · GHSA-fjqc-hq36-qh5p

medium2026-06-25

chi Has an IP Spoofing Vulnerability in `middleware.RealIP`

go-chi/chi · GHSA-3fxj-6jh8-hvhx

high2026-06-25

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

go-chi/chi · GHSA-rjr7-jggh-pgcp

high2026-06-25

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

go-chi/chi · GHSA-9g5q-2w5x-hmxf

medium2026-06-25

FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks

gtsteffaniak/filebrowser · GHSA-r4v7-6wcg-ghj5

low2026-06-25

fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`

epicvon2468/fixurjavainstall · GHSA-fq3w-p4fg-mw73

low2026-06-25

neotoma has tenant isolation gap in relationship query endpoints

markmhendrickson/neotoma · GHSA-wrr4-782v-jhwh

medium2026-06-25

justhtml: to_markdown() code-span blank-line breakout enables XSS

emilstenstrom/justhtml · GHSA-jf6w-2mvx-633j

critical2026-06-25

CVE-2026-48713-i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

i18next/i18next-fs-backend · GHSA-2933-q333-qg83

critical2026-06-25

CVE-2026-48714-i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

i18next/i18next-http-middleware · GHSA-f49m-vf83-692w

high2026-06-25

CVE-2026-46560-OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing

openidentityplatform/openam · GHSA-386j-6m86-78f9

high2026-06-25

CVE-2026-46498-OpenAM Arbitrary OAuth Token Minting via Push Registration

openidentityplatform/openam · GHSA-cj8f-2fhf-826r

medium2026-06-25

CVE-2026-46406-@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write

anthropics/claude-code · GHSA-4vp2-6q8c-pvq2

high2026-06-25

CVE-2026-45794-OpenAM has Unsafe Java Deserialization via SNS

openidentityplatform/openam · GHSA-pp89-732f-3g8q