Security advisories

high2026-06-15

CVE-2026-50170-@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

angular/angular · GHSA-q6f4-qqrg-jv6x

medium2026-06-15

CVE-2026-52725-@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

angular/angular · GHSA-692r-grfm-v8x7

medium2026-06-15

CVE-2026-48761-Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

symfony/symfony · GHSA-x5qj-865h-mgvm

medium2026-06-15

CVE-2026-50169-Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

angular/angular · GHSA-gv2q-mqqv-365m

high2026-06-15

CVE-2026-50168-@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass

angular/angular · GHSA-xrxm-cp7j-8xf6

high2026-06-15

CVE-2026-49982-tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template

raszi/node-tmp · GHSA-7c78-jf6q-g5cm

high2026-06-15

CVE-2026-48779-ws: Memory exhaustion DoS from tiny fragments and data chunks

websockets/ws · GHSA-96hv-2xvq-fx4p

high2026-06-15

CVE-2026-54267-Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

angular/angular · GHSA-rgjc-h3x7-9mwg

low2026-06-15

CVE-2026-12202-Subrion CMS vulnerable to Cross-site Scripting

intelliants/subrion · GHSA-wrcg-234w-hfhq

medium2026-06-15

CVE-2026-12208-jsonata: Function Binding Prototype Pollution via hasOwnProperty Override

jsonata-js/jsonata · GHSA-663r-x48j-fg8p

medium2026-06-15

CVE-2026-12198-Microweber vulnerable to Path Traversal

microweber/microweber · GHSA-vv4x-qcpq-wgrg

medium2026-06-14

CVE-2026-54421-OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

openstack/ironic · GHSA-j4cw-mcg2-2q78

critical2026-06-13

CVE-2026-11624-MCP Toolbox for Databases has an Origin Validation Error

googleapis/mcp-toolbox · GHSA-76g7-m3xw-x9gr

high2026-06-12

CVE-2026-54090-File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection

filebrowser/filebrowser · GHSA-8c9q-7855-wfxq

high2026-06-12

CVE-2026-54091-File Browser has incorrect access control for public directory shares via rule path rebasing

filebrowser/filebrowser · GHSA-j9jx-hp4c-ghhh

medium2026-06-12

CVE-2026-54093-File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames

filebrowser/filebrowser · GHSA-gxjx-7m74-hcq8

medium2026-06-12

CVE-2026-54094-File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope

filebrowser/filebrowser · GHSA-239w-m3h6-ch8v

high2026-06-12

CVE-2026-54092-File Browser has a DoS Vulnerability via Public Login API

filebrowser/filebrowser · GHSA-w5fm-68j4-fpc4

high2026-06-12

CVE-2026-54096-File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

filebrowser/filebrowser · GHSA-3q2p-72cj-682c

medium2026-06-12

CVE-2026-54697-ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing

connectbot/cbssh · GHSA-vc8p-8pxg-rfwg