Security advisories

high2026-06-22

CVE-2026-41573-OpenAM has LDAP Injection via `_queryId` Parameter

openidentityplatform/openam · GHSA-2vg8-q4c2-5cw3

medium2026-06-22

CVE-2026-33731-AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

wwbn/avideo · GHSA-95jh-7r58-xmxw

high2026-06-22

CVE-2025-67303-ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

comfy-org/comfyui-manager · GHSA-95pq-hr8p-f5g7

high2026-06-22

CVE-2026-33692-AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration

wwbn/avideo · GHSA-wf69-r4mx-43rr

critical2026-06-22

CVE-2026-12249-Canonical ADSys Uses a Less Trusted Source

ubuntu/adsys · GHSA-crm4-q7v4-c2r2

high2026-06-22

CVE-2026-42127-Grafana: Pre-authentication denial of service in the public dashboard query handler

grafana/grafana · GHSA-3w66-95m3-8jxg

low2026-06-22

CVE-2026-8823-Mattermost has an Incorrect Authorization issue

mattermost/mattermost · GHSA-xmfh-3ccg-c9fx

critical2026-06-22

CVE-2026-56104-Chainlit contains a session hijacking vulnerability

chainlit/chainlit · GHSA-c39v-8hrw-h448

medium2026-06-22

CVE-2026-12479-Keras: DiskIOStore permits path traversal through crafted layer names

keras-team/keras · GHSA-gh82-f9x8-5frx

medium2026-06-22

CVE-2026-33684-AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

wwbn/avideo · GHSA-8j8m-p79x-g4jm

critical2026-06-22

CVE-2026-33646-Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

jdx/mise · GHSA-fjj5-v948-whjj

medium2026-06-22

CVE-2026-32315-motionEye's World-Readable Configuration File Exposes Admin Password Hash

motioneye-project/motioneye · GHSA-rhgp-6wq6-9j67

medium2026-06-22

CVE-2026-31978-motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint

motioneye-project/motioneye · GHSA-g9fx-5r4h-pcw3

high2026-06-22

CVE-2026-25119-Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers

gogs/gogs · GHSA-w6j9-vw59-27wv

high2026-06-22

CVE-2026-21887-OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature

opencti-platform/opencti · GHSA-ffm6-vvph-g5f5

medium2026-06-22

CVE-2025-64719-Gogs has a Denial of Service in repository/wiki file listing web pages

gogs/gogs · GHSA-3qq3-668m-v9mj

critical2026-06-22

CVE-2025-58048-Paymenter vulnerable to Remote Code Execution via public file uploads

paymenter/paymenter · GHSA-5pm9-r2m8-rcmj

medium2026-06-22

CVE-2024-37155-OpenCTI May Bypass Introspection Restriction

opencti-platform/opencti · GHSA-4mvw-j8r9-xcgc

medium2026-06-22

CVE-2026-9162-Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation

mattermost/mattermost · GHSA-h998-hxxj-8q83

low2026-06-22

CVE-2026-8074-Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint

mattermost/mattermost · GHSA-g5vr-6pgg-74qv