Security advisories

medium2026-06-23

CVE-2026-54516-jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields

fasterxml/jackson-databind · GHSA-9fxm-vc8v-hj55

medium2026-06-23

CVE-2026-54515-jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

fasterxml/jackson-databind · GHSA-5jmj-h7xm-6q6v

medium2026-06-23

CVE-2026-54514-jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

fasterxml/jackson-databind · GHSA-hgj6-7826-r7m5

high2026-06-23

CVE-2026-54513-jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

fasterxml/jackson-databind · GHSA-rmj7-2vxq-3g9f

high2026-06-23

CVE-2026-54512-jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation

fasterxml/jackson-databind · GHSA-j3rv-43j4-c7qm

medium2026-06-23

CVE-2026-50193-jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

fasterxml/jackson-databind · GHSA-3wrr-7qpf-2prh

medium2026-06-23

CVE-2026-54518-jackson-databind has a @JsonView bypass for unwrapped creator parameters

fasterxml/jackson-databind · GHSA-rcqc-6cw3-h962

medium2026-06-23

AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

wwbn/avideo · GHSA-7cqp-7cfv-6c3q

critical2026-06-23

motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal

motioneye-project/motioneye · GHSA-phv5-334h-mxcw

critical2026-06-23

motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)

motioneye-project/motioneye · GHSA-qxvg-h7q2-hcxh

medium2026-06-23

CVE-2026-55863-motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution

motioneye-project/motioneye · GHSA-j67x-q29f-qcvv

high2026-06-23

CVE-2026-55488-motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read

motioneye-project/motioneye · GHSA-rw9q-97r9-8gvh

high2026-06-23

CVE-2026-56695-OpenHarness remote resume commands expose other users' saved session snapshots

hkuds/openharness · GHSA-399c-3gm2-p29v

medium2026-06-23

CVE-2026-56696-OpenHarness remote project-context commands allow persistent prompt poisoning

hkuds/openharness · GHSA-24cw-228q-3rx9

medium2026-06-23

CVE-2026-55448-Mise's local credential_command executes untrusted config

jdx/mise · GHSA-29hf-rm4x-xxph

high2026-06-23

CVE-2026-55441-Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository

jdx/mise · GHSA-77g9-363w-rccq

medium2026-06-23

CVE-2026-54557-mise HTTP backend uses raw version path for install symlink destination

jdx/mise · GHSA-f94h-j2qg-fxw3

high2026-06-23

CVE-2026-54134-OctoPrint has possible file exfiltration via query parameters on upload endpoints

octoprint/octoprint · GHSA-j4h9-pm27-4rfw

high2026-06-23

CVE-2026-53925-Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration

nicolargo/glances · GHSA-3vwc-qwhc-3mj7

critical2026-06-23

CVE-2026-54350-Budibase has nonymous NoSQL operator injection via published-app query templates

budibase/budibase · GHSA-8qv3-p479-cj62