Security advisories

medium2026-06-16

Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes

mozilla/bleach · GHSA-gj48-438w-jh9v

medium2026-06-16

Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning

mozilla/bleach · GHSA-g75f-g53v-794x

low2026-06-16

Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output

mozilla/bleach · GHSA-8rfp-98v4-mmr6

medium2026-06-16

CVE-2026-54531-pypdf: Possible infinite loop when processing outlines/bookmarks in writer

py-pdf/pypdf · GHSA-m2v9-299j-rv96

medium2026-06-16

CVE-2026-54530-pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

py-pdf/pypdf · GHSA-52x6-gq3r-vpf4

high2026-06-16

CVE-2026-50146-Astro: Reflected XSS via unescaped slot name

withastro/astro · GHSA-8hv8-536x-4wqp

medium2026-06-16

CVE-2026-53722-Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

nuxt/nuxt · GHSA-934w-87qh-qr26

medium2026-06-16

CVE-2026-56301-Nuxt dev server vite-node IPC socket is world-connectable on Linux

nuxt/nuxt · GHSA-534h-c3cw-v3h9

high2026-06-16

CVE-2026-53721-Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

nuxt/nuxt · GHSA-mm7m-92g8-7m47

medium2026-06-16

CVE-2026-56326-Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`

nuxt/nuxt · GHSA-c9cv-mq2m-ppp3

medium2026-06-16

CVE-2026-49461-pypdf: Possible large memory usage for form XObjects during text extraction

py-pdf/pypdf · GHSA-j543-4vmf-qm7v

medium2026-06-16

CVE-2026-49460-pypdf: Inefficient decoding of FlateDecode PNG predictor streams

py-pdf/pypdf · GHSA-5hgr-hg42-57jg

medium2026-06-16

CVE-2026-48735-pypdf: Manipulated XMP metadata streams can exhaust RAM

py-pdf/pypdf · GHSA-wjqc-6w8f-h24c

high2026-06-15

CVE-2026-50891-Filestash allows attackers to escalate privileges via sending a crafted request

mickael-kerjean/filestash · GHSA-rcqf-cpv9-g5jf

critical2026-06-15

CVE-2026-50887-shlink has a Server-Side Request Forgery issue

shlinkio/shlink · GHSA-p85r-x2wj-mxqj

high2026-06-15

CVE-2026-50888-Koillection has an authenticated Server-Side Request Forgery issue

benjaminjonard/koillection · GHSA-gmxh-hjfv-qc2w

high2026-06-15

CVE-2026-50879-linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST request

andreimarcu/linx-server · GHSA-g743-m6x3-v6wm

critical2026-06-15

CVE-2026-50886-Project Firefly III has incorrect access control in the webhook management component

firefly-iii/firefly-iii · GHSA-9mmg-q95p-gp67

critical2026-06-15

CVE-2026-50880-YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution

youtransfer/youtransfer · GHSA-68mc-h6h8-79wj

high2026-06-15

CVE-2026-50884-statping-ng allows attackers to escalate privileges to Administrator and access sensitive components

statping-ng/statping-ng · GHSA-5442-mh7f-72px