Security advisories

medium2026-06-19

CVE-2026-55766-guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization

guzzle/psr7 · GHSA-vm85-hxw5-5432

medium2026-06-19

CVE-2026-55689-OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset

openfga/openfga · GHSA-hcxc-wf8j-23hv

low2026-06-19

CVE-2026-11525-undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

nodejs/undici · GHSA-g8m3-5g58-fq7m

high2026-06-19

CVE-2026-12151-undici WebSocket client vulnerable to denial of service via fragment count bypass

nodejs/undici · GHSA-vxpw-j846-p89q

medium2026-06-19

CVE-2026-9679-undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

nodejs/undici · GHSA-p88m-4jfj-68fv

high2026-06-19

CVE-2026-6734-undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

nodejs/undici · GHSA-hm92-r4w5-c3mj

low2026-06-19

CVE-2026-6733-undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

nodejs/undici · GHSA-35p6-xmwp-9g52

medium2026-06-19

CVE-2026-55568-guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

guzzle/guzzle · GHSA-wpwq-4j6v-78m3

medium2026-06-19

CVE-2026-55414-NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

nl-portal/nl-portal-backend-libraries · GHSA-xm3x-9cfw-jhx4

medium2026-06-19

CVE-2026-55375-canto-saas-api: OAuth credentials exposed in URL query string and exception messages

jleehr/canto-saas-api · GHSA-37pm-83g7-r22v

medium2026-06-19

CVE-2026-55374-canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

jleehr/canto-saas-api · GHSA-9qfv-wgh2-m6p8

critical2026-06-19

CVE-2026-55884-Tilt: Missing authentication on the network-exposed Tilt HUD server

tilt-dev/tilt · GHSA-c73q-8xxr-rgqm

high2026-06-19

CVE-2026-55883-Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream

tilt-dev/tilt · GHSA-6m68-r693-78qx

high2026-06-19

CVE-2026-55882-Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server

tilt-dev/tilt · GHSA-p749-9w62-w533

critical2026-06-19

CVE-2026-54051-Network-AI: Improper Neutralization of Special Elements used in an OS Command

jovancoding/network-ai · GHSA-qw6v-5fcf-5666

critical2026-06-19

CVE-2026-48814-Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests

jovancoding/network-ai · GHSA-r78r-rwrf-rjwp

medium2026-06-19

CVE-2026-12644-ts-deepmerge: Prototype Method Override leads to DoS

voodoocreation/ts-deepmerge · GHSA-87mf-gv2c-c62c

medium2026-06-19

CVE-2026-10720-Canonical MicroCeph: path traversal issue in the remote-import AP

canonical/microceph · GHSA-xg3j-c7q4-f9ph

medium2026-06-18

CVE-2026-55591-Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

signalk/signalk-server · GHSA-q59x-jc9f-gfqf

medium2026-06-18

PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle

web-token/jwt-framework · GHSA-5739-39v2-5754