Security advisories

medium2026-06-22

CVE-2026-46700-@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

actualbudget/actual · GHSA-3f62-qv96-4p78

medium2026-06-22

CVE-2026-46672-@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper

actualbudget/actual · GHSA-7gh7-258j-4mpq

medium2026-06-22

CVE-2026-46611-Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack

nicolargo/glances · GHSA-w856-8p3r-p338

high2026-06-22

CVE-2026-39904-Gophish contains a denial of service vulnerability

gophish/gophish · GHSA-42jc-v69j-g38f

high2026-06-22

CVE-2026-46608-Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

nicolargo/glances · GHSA-87qc-fj39-wccr

high2026-06-22

CVE-2026-46607-Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution

nicolargo/glances · GHSA-9837-48hr-q32j

high2026-06-22

CVE-2026-46606-Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

nicolargo/glances · GHSA-v5r2-qh84-fjx5

critical2026-06-22

CVE-2026-46495-OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

openidentityplatform/opendj · GHSA-43x2-g84q-fmqx

critical2026-06-22

CVE-2026-46488-motionEye: Authentication possible via password hash

motioneye-project/motioneye · GHSA-r3cw-c95m-wfh9

high2026-06-22

CVE-2026-44795-Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types

spinnaker/spinnaker · GHSA-c8q4-9h32-2ww8

low2026-06-22

CVE-2026-44793-OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`

openidentityplatform/openam · GHSA-fhrq-3gmx-p879

low2026-06-22

CVE-2026-44778-Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (no shipped gadget affected)

inspektor-gadget/inspektor-gadget · GHSA-7cfq-5mhv-jrp9

medium2026-06-22

CVE-2026-44585-Paymenter has broken object level authorization via service reference manipulation on ticket creation

paymenter/paymenter · GHSA-x93q-x9pc-w5hw

medium2026-06-22

CVE-2026-44584-Paymenter doesn't reset email verification status after email change

paymenter/paymenter · GHSA-rv89-wch8-c574

medium2026-06-22

CVE-2026-44583-Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module

paymenter/paymenter · GHSA-7wwh-xcc3-9fcg

medium2026-06-22

CVE-2026-44517-Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

podman-container-tools/buildah · GHSA-49p4-px3h-rq49

high2026-06-22

CVE-2026-44203-OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

openidentityplatform/openam · GHSA-fq9h-c788-fx73

medium2026-06-22

CVE-2026-44202-OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

openidentityplatform/openam · GHSA-c556-q2mh-477v

critical2026-06-22

CVE-2026-44179-xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro

xwikisas/xwiki-pro-macros · GHSA-w56x-9778-rppx

medium2026-06-22

CVE-2026-41579-runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

opencontainers/runc · GHSA-xjvp-4fhw-gc47