Security Advisories

high2026-10-08

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

datamodel-code-generator/datamodel-code-generator · GHSA-77xj-x4rm-935c · CVE-2026-107377

medium2026-10-08

PraisonAI: Project custom command templates can read outside-workspace files into model prompts

mervinpraison/praisonai · GHSA-xpx6-x8c2-mw5w · CVE-2026-60088

medium2026-10-08

Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

handlebars-lang/handlebars.js · GHSA-xw65-4hp5-5hc7 · CVE-2026-106444

critical2026-10-08

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

handlebars-lang/handlebars.js · GHSA-8r5x-fm3f-whwj · CVE-2026-106446

critical2026-10-08

Handlebars: JavaScript Injection via Own Property Check Bypass

handlebars-lang/handlebars.js · GHSA-p8wg-vrv2-v86f · CVE-2026-106445

medium2026-10-08

LangChain: MongoDBChatMessageHistory query injection can allow cross-session access

langchain-ai/langchainjs · GHSA-m6rx-h84q-8r95 · CVE-2026-106119

high2026-10-08

Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

qax-os/excelize · GHSA-mx22-3794-2vpv · CVE-2026-107211

medium2026-10-08

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

corazawaf/coraza · GHSA-rp9v-7xv3-r6g3 · CVE-2026-107834

medium2026-10-08

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

corazawaf/coraza · GHSA-w253-m66g-rx24

medium2026-10-08

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

corazawaf/coraza · GHSA-3c6w-j9xm-8h2h · CVE-2026-107833

medium2026-10-08

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

corazawaf/coraza · GHSA-3wr7-993q-jrff

medium2026-10-08

Coraza has Cookie Parser Confusion

corazawaf/coraza · GHSA-g4qm-m288-5cp9

medium2026-10-08

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

corazawaf/coraza · GHSA-x26q-wvhg-fh4m · CVE-2026-107825

medium2026-10-08

Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

corazawaf/coraza · GHSA-pc5q-qfxp-ggqv · CVE-2026-104774

high2026-10-08

Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

corazawaf/coraza · GHSA-6gcq-wc29-5xf2 · CVE-2026-107826

medium2026-10-08

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

corazawaf/coraza · GHSA-5gj4-9gm7-2fx2

medium2026-10-08

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

pydantic/pydantic-ai · GHSA-v36g-jcw9-x7cw · CVE-2026-107287

high2026-10-08

JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

jhipster/generator-jhipster · GHSA-r223-96jv-q533 · CVE-2026-107375

high2026-10-08

JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob

jhipster/generator-jhipster · GHSA-9ffp-22j7-56r2 · CVE-2026-107303

high2026-10-08

msgpack5: Truncated map32 headers throw an unexpected error

mcollina/msgpack5 · GHSA-8f34-f56x-9xph · CVE-2026-107302