Security advisories

low2026-06-21

CVE-2026-12772-LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration

berriai/litellm · GHSA-mf52-j94g-746m

low2026-06-21

CVE-2026-12770-LiteLLM: Admin Key Handler Has Improper Authorization

berriai/litellm · GHSA-6qr3-3g89-m4jj

high2026-06-19

CVE-2026-59153-Anki's local HTTP server does not sufficiently validate requests

ankitects/anki · GHSA-869j-r97x-hx2g

medium2026-06-19

SurrealDB: Denial of Service via deep operator chains

surrealdb/surrealdb · GHSA-jv2j-mqmw-xvv5

medium2026-06-19

CVE-2026-63738-SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals

surrealdb/surrealdb · GHSA-hv6h-hc26-q48p

medium2026-06-19

SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field

surrealdb/surrealdb · GHSA-h4h3-3rfj-x6fq

high2026-06-19

SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter

surrealdb/surrealdb · GHSA-cc8f-fcx3-gpjr

medium2026-06-19

SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch

surrealdb/surrealdb · GHSA-h5rg-8p7f-47g2

medium2026-06-19

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

pydantic/pydantic-settings · GHSA-4xgf-cpjx-pc3j

high2026-06-19

Lokka: Azure Resource Manager URL path validation issue

merill/lokka · GHSA-g2gw-q38m-vjfc

high2026-06-19

@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

jhb-software/payload-plugins · GHSA-h5x8-xp6m-x6q4

high2026-06-19

LangSmith SDK TracingMiddleware: Arbitrary server-side file read

langchain-ai/langsmith-sdk · GHSA-f4xh-w4cj-qxq8

high2026-06-19

githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

gouef/githubtoplanguages · GHSA-c3xh-98xp-6qhf

medium2026-06-19

CVE-2026-11941-Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions

cloudflare/quiche · GHSA-mh64-ph39-mrc9

medium2026-06-19

Zeep: Server-Side Request Forgery (SSRF)

mvantellingen/python-zeep · GHSA-4cc2-g9w2-fhf6

medium2026-06-19

Anki: User scripts in iframes have access to the internal Anki API

ankitects/anki · GHSA-cw6h-ffmh-x6vh

medium2026-06-19

ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer

gunthercox/chatterbot · GHSA-wvrh-2f4m-924v

critical2026-06-19

CVE-2026-56120-OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

openremote/openremote · GHSA-h3m5-97jq-qjrf

high2026-06-19

appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)

appium/appium-mcp · GHSA-x975-rgx4-5fh4

high2026-06-19

EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id

evermind-ai/everos · GHSA-c795-2g9c-j48m