Security advisories

high2026-06-16

CVE-2026-49444-n8n: Python sandbox escape

n8n-io/n8n · GHSA-9pq8-m8gp-4p53

critical2026-06-16

CVE-2026-48746-vLLM: OpenAI auth bypass

vllm-project/vllm · GHSA-94f4-hr76-p5j6

medium2026-06-16

CVE-2026-48520-Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read

langflow-ai/langflow · GHSA-rcjh-r59h-gq37

critical2026-06-16

CVE-2026-48519-Langflow: Unauthenticated RCE in Shareable Playgrounds

langflow-ai/langflow · GHSA-v5ff-9q35-q26f

medium2026-06-16

CVE-2026-42867-Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

langflow-ai/langflow · GHSA-79ph-745m-6wxq

high2026-06-16

CVE-2026-41523-vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

vllm-project/vllm · GHSA-q8gq-377p-jq3r

high2026-06-16

CVE-2026-33760-Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints

langflow-ai/langflow · GHSA-9c59-2mvc-vfr8

high2026-06-16

CVE-2026-12398-Galaxy NG: command injection vulnerability

ansible/galaxy_ng · GHSA-6hw7-j4jw-wpff

medium2026-06-16

CVE-2026-55599-phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access

phpseclib/phpseclib · GHSA-m557-wrgg-6rp4

medium2026-06-16

CVE-2026-55443-LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

langchain-ai/langchain · GHSA-gr75-jv2w-4656

medium2026-06-16

CVE-2026-54298-Astro: XSS via Unescaped Attribute Names in Spread Props

withastro/astro · GHSA-jrpj-wcv7-9fh9

high2026-06-16

CVE-2026-54299-Astro: Host header SSRF in prerendered error page fetch

withastro/astro · GHSA-2pvr-wf23-7pc7

medium2026-06-16

CVE-2026-54300-@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config

withastro/astro · GHSA-529g-xq4f-cw38

high2026-06-16

CVE-2026-54293-Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

nltk/nltk · GHSA-p4gq-832x-fm9v

medium2026-06-16

CVE-2026-45491-Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

dotnet/runtime · GHSA-7q4v-2mr6-5gpx

medium2026-06-16

CVE-2026-54288-hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

honojs/hono · GHSA-rv63-4mwf-qqc2

medium2026-06-16

CVE-2026-54289-hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

honojs/hono · GHSA-wgpf-jwqj-8h8p

high2026-06-16

CVE-2026-54290-hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

honojs/hono · GHSA-88fw-hqm2-52qc

medium2026-06-16

CVE-2026-54286-hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

honojs/hono · GHSA-wwfh-h76j-fc44

medium2026-06-16

CVE-2026-54287-hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

honojs/hono · GHSA-j6c9-x7qj-28xf