Security advisories

high2026-06-11

CVE-2026-48089-DevGuard has improper authorization on public assets

l3montree-dev/devguard · GHSA-6p54-fw2f-q7gf

medium2026-06-11

CVE-2026-48067-Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields

filamentphp/filament · GHSA-7q3w-xqjw-g3cr

high2026-06-11

CVE-2026-48059-Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

netty/netty · GHSA-h2qv-fj59-j46j

medium2026-06-11

CVE-2026-11986-Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks

keycloak/keycloak · GHSA-6w3v-mcfh-m3q7

critical2026-06-11

CVE-2026-48062-CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule

codeigniter4/codeigniter4 · GHSA-2gr4-ppc7-7mhx

medium2026-06-11

CVE-2026-48053-Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

learningequality/kolibri · GHSA-4mj9-pf4r-cqrc

high2026-06-11

CVE-2026-48050-Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

basekick-labs/arc · GHSA-j93g-rp6m-j32m

medium2026-06-11

CVE-2026-48049-@hapi/inert has a static-file confinement bypass via sibling-prefix path

hapijs/inert · GHSA-rcvq-m9j9-6f4g

high2026-06-11

CVE-2026-11816-Keras archive extraction utilities allow path traversal and arbitrary file writes

keras-team/keras · GHSA-hqp4-2352-xf5r

medium2026-06-11

CVE-2026-48045-python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

python-zeroconf/python-zeroconf · GHSA-9663-mqmp-p9mm

medium2026-06-11

CVE-2026-48043-netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

netty/netty · GHSA-c2gf-v879-257j

medium2026-06-11

CVE-2026-48040-netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access

netty/netty-incubator-codec-ohttp · GHSA-32hf-8jw3-v4qq

critical2026-06-11

CVE-2026-48039-Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

pipeboard-co/meta-ads-mcp · GHSA-9gw6-46qc-99vr

high2026-06-11

CVE-2026-48068-@grpc/grpc-js: A malformed request can cause a server crash

grpc/grpc-node · GHSA-5375-pq7m-f5r2

high2026-06-11

CVE-2026-48069-@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

grpc/grpc-node · GHSA-99f4-grh7-6pcq

medium2026-06-11

CVE-2026-48038-joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

hapijs/joi · GHSA-q7cg-457f-vx79

high2026-06-11

CVE-2026-48054-OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

openzeppelin/contracts-wizard · GHSA-4x76-22x2-rx8v

medium2026-06-11

CVE-2026-48022-@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

hapijs/wreck · GHSA-x426-x7cc-3fpc

high2026-06-11

CVE-2026-48020-Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization

traefik/traefik · GHSA-xf64-8mw2-4gr2

high2026-06-11

CVE-2026-48007-Element Call reports full URLs of visited pages to analytics server

element-hq/element-call · GHSA-6vhh-4xw6-h2h2