Security advisories

medium2026-06-19

CVE-2026-55865-Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

jg-rp/liquid · GHSA-vq2f-vcc9-j8mv

high2026-06-19

CVE-2026-54898-Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation

ohler55/oj · GHSA-q2gm-54r6-8fwm

high2026-06-19

CVE-2026-54897-Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close

ohler55/oj · GHSA-9ppp-w3g4-fh4q

high2026-06-19

CVE-2026-54896-Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent

ohler55/oj · GHSA-35w3-pjm6-wj95

low2026-06-19

CVE-2026-55778-parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

parse-community/parse-server · GHSA-v8x7-r927-cc93

high2026-06-19

CVE-2026-54592-Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

ohler55/oj · GHSA-3m6q-jj5j-38c9

high2026-06-19

CVE-2026-54528-jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

jupyterlab/jupyterlab-git · GHSA-436q-jwfr-rm2h

high2026-06-19

CVE-2026-54527-jupyterlab-git extension: Stored XSS leading to RCE

jupyterlab/jupyterlab-git · GHSA-f962-v9hr-pfg5

medium2026-06-19

CVE-2026-54500-Oj: intern.c form_attr (uninitialized stack read)

ohler55/oj · GHSA-fm7p-mprw-wjm9

high2026-06-19

CVE-2026-54499-Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

stanfordnlp/stanza · GHSA-v5jw-96jm-7h2c

high2026-06-19

CVE-2026-54317-Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN

home-assistant/core · GHSA-x84v-g949-293w

high2026-06-19

CVE-2026-54297-Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

lostisland/faraday · GHSA-98m9-hrrm-r99r

high2026-06-19

CVE-2026-53492-containerd CRI checkpoint restore CDI annotation smuggling

containerd/containerd · GHSA-33vj-92qq-66hc

high2026-06-19

CVE-2026-53489-Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

containerd/containerd · GHSA-rgh6-rfwx-v388

high2026-06-19

CVE-2026-53488-containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

containerd/containerd · GHSA-xhf5-7wjv-pqxp

high2026-06-19

CVE-2026-54502-Oj: Stack Buffer Overflow in Oj.dump via Large Indent

ohler55/oj · GHSA-3v45-f3vh-wg7m

medium2026-06-19

CVE-2026-50195-containerd: CRI checkpoint import allows local image tag poisoning

containerd/containerd · GHSA-cvxm-645q-p574

medium2026-06-19

CVE-2026-53726-parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

parse-community/parse-server · GHSA-wmwx-jr2p-4j4r

medium2026-06-19

CVE-2026-53725-parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied

parse-community/parse-server · GHSA-75v4-m273-5j49

low2026-06-19

CVE-2026-53724-parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist

parse-community/parse-server · GHSA-7wqv-xjf3-x35v