Security advisories

medium2026-06-16

CVE-2026-50135-Hugo: Symlink confinement bypass in resources.Get

gohugoio/hugo · GHSA-fw87-fv5r-9fpw

medium2026-06-16

CVE-2026-50134-Hugo: security.http.urls allow-list bypass via HTTP redirects

gohugoio/hugo · GHSA-vxgm-5rmg-5w8g

medium2026-06-16

CVE-2026-50133-Hugo: XSS via text/html content files

gohugoio/hugo · GHSA-c54g-xjwj-8g82

high2026-06-16

CVE-2026-49401-Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

denoland/deno · GHSA-8xpq-cjcf-3wh9

medium2026-06-16

CVE-2026-49406-Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

denoland/deno · GHSA-968w-xfqw-vp9q

medium2026-06-16

CVE-2026-49411-Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

denoland/deno · GHSA-v8fw-85r8-5m23

high2026-06-16

CVE-2026-49440-Deno: Miller-Rabin Primality Test Allows Zero Rounds

denoland/deno · GHSA-9xg4-qhm4-g43w

high2026-06-16

CVE-2026-49402-Deno: Command Injection via spawnSync & spawn on Windows

denoland/deno · GHSA-7xh3-mhg9-jcw8

medium2026-06-16

CVE-2026-49983-Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access

denoland/deno · GHSA-4c8g-jvcx-v4hv

medium2026-06-16

CVE-2026-49860-Deno: WebSocket API sandbox bypass via missing post-DNS check

denoland/deno · GHSA-83pc-3rw9-qpwj

medium2026-06-16

CVE-2026-49859-Deno: `fetch()` API sandbox bypass via missing DNS resolution check

denoland/deno · GHSA-cpgj-f7g3-2pp2

high2026-06-16

CVE-2026-48491-Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

traefik/traefik · GHSA-5r4w-85f3-pw66

medium2026-06-16

CVE-2026-54311-n8n: Merge Node SQL Mode Prototype Pollution

n8n-io/n8n · GHSA-9c38-2mcm-q7f7

medium2026-06-16

CVE-2026-54306-n8n: Prototype Pollution enables confused-deputy execution via public webhooks

n8n-io/n8n · GHSA-2vff-hj5x-8gq7

high2026-06-16

CVE-2026-54301-n8n: Same-Origin XSS in Respond to Webhook Node

n8n-io/n8n · GHSA-v733-mwr6-fgcm

medium2026-06-16

CVE-2026-54308-n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes

n8n-io/n8n · GHSA-jvc7-762p-3743

medium2026-06-16

n8n: Wrong OAuth Scope On Evaluations Test Run Creation Endpoint

n8n-io/n8n · GHSA-hv7x-3x78-gx53

medium2026-06-16

CVE-2026-54313-n8n: NoSQL Injection in MongoDB Node Find And Replace Operation

n8n-io/n8n · GHSA-jpq7-226w-6cxx

medium2026-06-16

CVE-2026-54310-n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

n8n-io/n8n · GHSA-c37g-w77q-m4vp

medium2026-06-16

CVE-2026-49465-n8n: Git Node Clone and Push Operations Bypass File Sandbox

n8n-io/n8n · GHSA-5xp3-2w67-427v