Security advisories

medium2026-06-19

CVE-2026-55846-Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read

allure-framework/allure2 · GHSA-82cg-3hv7-74gc

high2026-06-19

VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files

kevin1024/vcrpy · GHSA-rpj2-4hq8-938g

medium2026-06-19

CVE-2026-55837-dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

dbt-labs/dbt-mcp · GHSA-jr33-mw75-7j8f

high2026-06-19

Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser

gatenlp/ultimate-sitemap-parser · GHSA-p5wc-9w9r-m232

high2026-06-19

Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit

gatenlp/ultimate-sitemap-parser · GHSA-8823-qg2x-pv9f

medium2026-06-19

CVE-2026-55828-go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)

qbee-io/transport · GHSA-f9m7-vc86-p6jj

high2026-06-19

CVE-2026-55660-TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

tinacms/tinacms · GHSA-g5qx-h5f3-mp2f

medium2026-06-19

CVE-2026-55795-Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

craftcms/commerce · GHSA-h5gm-x9wr-vhcm

medium2026-06-19

Craft Commerce: Partial Payment Amount Without Lower Bound Validation

craftcms/commerce · GHSA-78vr-q6cf-c7p6

critical2026-06-19

CVE-2026-55791-Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

craftcms/cms · GHSA-c55v-343g-5xff

high2026-06-19

CVE-2026-54074-@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

tinacms/tinacms · GHSA-4936-9hrh-qqpw

high2026-06-19

CVE-2026-55691-StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

starcitizenwiki/mediawiki-extensions-embedvideo · GHSA-7h5p-637f-jfr7

high2026-06-19

CVE-2026-55690-StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text

starcitizenwiki/mediawiki-extensions-embedvideo · GHSA-c29q-5xm7-5p62

medium2026-06-19

CVE-2026-11769-Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

grafana/grafana-operator · GHSA-fcw4-wwqm-m8cf

critical2026-06-19

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

crossplane/crossplane · GHSA-wfqx-gjrf-g28r

high2026-06-19

CVE-2026-55091-flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

joaonuno/flat-to-nested-js · GHSA-hp36-v28f-w3r4

high2026-06-19

CVE-2026-55849-@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument

cyclonedx/cyclonedx-node-npm · GHSA-v75r-vx73-82pj

high2026-06-19

Blocky DNSSEC validation bypass and validation-cache scope pollution

0xerr0r/blocky · GHSA-x845-2f78-7v36

medium2026-06-19

CVE-2026-54911-UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

ultrajson/ultrajson · GHSA-3j69-69wj-xqx2

low2026-06-19

CVE-2026-54906-Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption

ruby-concurrency/concurrent-ruby · GHSA-6wx8-w4f5-wwcr