Security advisories

high2026-06-23

CVE-2026-55173-AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink

wwbn/avideo · GHSA-wc3f-xc32-435f

medium2026-06-23

CVE-2026-52816-Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

gogs/gogs · GHSA-3w28-36p9-w929

high2026-06-23

CVE-2026-45049-OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet

openidentityplatform/openam · GHSA-r9pv-5rpp-vm8g

high2026-06-23

CVE-2026-45048-OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

openidentityplatform/openam · GHSA-vvhj-w2jq-263q

medium2026-06-23

CVE-2026-35163-OctoPrint has XSS in its Suppressed Command Notifications

octoprint/octoprint · GHSA-p6qx-ghxm-389h

medium2026-06-23

CVE-2026-52815-Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API

gogs/gogs · GHSA-744x-3838-5r56

medium2026-06-23

CVE-2026-52814-Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)

gogs/gogs · GHSA-xp79-5mx3-jx52

critical2026-06-23

CVE-2026-52813-Gogs has Path Traversal in organization name that results in RCE through Git hooks

gogs/gogs · GHSA-c39w-43gm-34h5

high2026-06-23

CVE-2026-52812-Gogs: LFS dedupe path leaks private repo content across tenants

gogs/gogs · GHSA-6p9m-q3jp-47h4

critical2026-06-23

CVE-2026-52811-Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

gogs/gogs · GHSA-89mr-xqfv-758m

high2026-06-23

CVE-2026-52810-Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion

gogs/gogs · GHSA-wmfg-5p4h-5fw3

medium2026-06-23

CVE-2026-52809-Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES

gogs/gogs · GHSA-5c3f-6486-3g7g

high2026-06-23

CVE-2026-52808-Gogs's write-level collaborators can mutate admin-only repository settings via API

gogs/gogs · GHSA-268j-37xf-pp52

medium2026-06-23

CVE-2026-52807-Gogs has DOM-based XSS via Milestone Name on New Issue Page

gogs/gogs · GHSA-vcm5-gvmp-78mp

critical2026-06-23

CVE-2026-52806-Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge

gogs/gogs · GHSA-qf6p-p7ww-cwr9

high2026-06-23

CVE-2026-52805-Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft

gogs/gogs · GHSA-g2f5-gjr4-qjvm

medium2026-06-23

CVE-2026-52804-Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation

gogs/gogs · GHSA-4565-r4x7-hg8j

medium2026-06-23

CVE-2026-52802-Gogs has an Open Redirect via redirect_to

gogs/gogs · GHSA-xxhq-69mf-w8cr

medium2026-06-23

CVE-2026-10609-OpenShift Cluster Logging Operator missing authorization flaw

openshift/cluster-logging-operator · GHSA-9xm2-gw56-wj7m

critical2026-06-23

CVE-2026-12866-expr-eval vulnerable to Code Execution

silentmatt/expr-eval · GHSA-q9v2-7m5w-4693