Security advisories

medium2026-06-12

CVE-2026-54700-ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation

connectbot/cbssh · GHSA-ch3q-cw5r-f4hg

high2026-06-12

CVE-2026-54097-File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix

filebrowser/filebrowser · GHSA-5ww9-jg6q-38r7

medium2026-06-12

CVE-2026-46371-Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

fleetdm/fleet · GHSA-x4qr-qw6h-wvxq

medium2026-06-12

CVE-2026-46370-Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

fleetdm/fleet · GHSA-vxm7-9x8v-8gm4

medium2026-06-12

CVE-2026-44311-Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

fabricjs/fabric.js · GHSA-w22m-hvvm-xmwx

medium2026-06-12

PyO3 has a missing `Sync` bound on `PyCFunction::new_closure` closures

pyo3/pyo3 · GHSA-chgr-c6px-7xpp

low2026-06-12

esbuild allows arbitrary file read when running the development server on Windows

evanw/esbuild · GHSA-g7r4-m6w7-qqqr

high2026-06-12

CVE-2026-53999-Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)

radius-project/radius · GHSA-fp5j-4fj2-4jvq

high2026-06-12

CVE-2026-11607-TYPO3 CMS has Broken Access Control in its Form Framework

typo3/typo3 · GHSA-pjpj-v387-x4vq

medium2026-06-12

CVE-2026-47349-TYPO3 CMS has Broken Access Control in the Recycler Module

typo3/typo3 · GHSA-f34x-rx2w-7pm3

medium2026-06-12

CVE-2026-47347-TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities

typo3/typo3 · GHSA-3p42-w5ch-gg42

high2026-06-12

CVE-2026-47343-TYPO3 CMS: Destructive Actions on File Mount Folders

typo3/typo3 · GHSA-3v8v-4wg6-r7qh

medium2026-06-12

CVE-2026-47345-TYPO3 HTML Sanitizer allows Cross-site Scripting

typo3/html-sanitizer · GHSA-p5j5-4j3q-8mq8

high2026-06-12

PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators

pyo3/pyo3 · GHSA-36hh-v3qg-5jq4

high2026-06-12

CVE-2026-49741-TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework

typo3/typo3 · GHSA-jh32-v29g-68pq

medium2026-06-12

CVE-2026-47350-TYPO3 CMS has Broken Access Control in its DataHandler

typo3/typo3 · GHSA-qcmw-6rm2-5x78

high2026-06-12

CVE-2026-47346-TYPO3 CMS has Broken Access Control in its Form Framework

typo3/typo3 · GHSA-hwvq-2w67-rvxp

high2026-06-12

CVE-2026-49742-TYPO3 CMS has Broken Access Control in its Media Module

typo3/typo3 · GHSA-chm7-4vch-h8vr

medium2026-06-12

CVE-2026-49740-TYPO3 CMS has Insecure Deserialization via Core API

typo3/typo3 · GHSA-c78m-c52x-jgwp

low2026-06-12

CVE-2026-49738-TYPO3 CMS has Broken Access Control in its File Abstraction Layer

typo3/typo3 · GHSA-jf56-v8jc-jcc5