Security advisories

high2026-06-08

CVE-2026-47735-Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

basekick-labs/arc · GHSA-p2j4-c4g6-rpf5

medium2026-06-08

CVE-2026-47734-Dulwich has unbounded memory allocation in receive-pack from crafted thin packs

jelmer/dulwich · GHSA-xrvj-v92f-53gj

high2026-06-08

CVE-2026-47726-nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

juev/nebula-mesh · GHSA-qm33-p5p9-f8vg

high2026-06-08

CVE-2026-47725-nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints

juev/nebula-mesh · GHSA-273q-qgh5-wrj6

critical2026-06-08

CVE-2026-47724-nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

juev/nebula-mesh · GHSA-598g-h2vc-h5vg

high2026-06-08

CVE-2026-47723-nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

juev/nebula-mesh · GHSA-w7w5-5gcp-38rw

high2026-06-08

CVE-2026-47722-nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

juev/nebula-mesh · GHSA-7hp6-g3pq-3pc3

medium2026-06-08

CVE-2026-47721-FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

frangoteam/fuxa · GHSA-8ghr-w65f-j3qr

medium2026-06-08

CVE-2026-47720-FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString

frangoteam/fuxa · GHSA-h9fj-c2qr-76g2

high2026-06-08

CVE-2026-47719-FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

frangoteam/fuxa · GHSA-w86f-rf9w-h3x6

low2026-06-08

CVE-2026-47712-Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`

jelmer/dulwich · GHSA-555p-6grf-mh7f

medium2026-06-08

CVE-2026-47693-Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications

poweradmin/poweradmin · GHSA-3h6h-67x3-cv5x

critical2026-06-08

CVE-2026-47252-Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin

julien040/anyquery · GHSA-hrj8-hjv8-mgwc

high2026-06-08

CVE-2026-47691-Netty has Insufficient Bailiwick Validation for NS Records

netty/netty · GHSA-5pvg-856g-cp85

medium2026-06-08

CVE-2026-47244-Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced

netty/netty · GHSA-5x3r-wrvg-rp6q

high2026-06-08

CVE-2026-46340-Netty: SCTP reassembly nests buffers without bound

netty/netty · GHSA-5xrh-qmmq-w6ch

high2026-06-08

CVE-2026-45674-Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

netty/netty · GHSA-676x-f7gg-47vc

medium2026-06-08

CVE-2026-45673-Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

netty/netty · GHSA-xmv7-r254-6q78

medium2026-06-08

CVE-2026-45536-Netty: Unix-socket fd receive leaks descriptors when peer sends two at once

netty/netty · GHSA-w573-9ffj-6ff9

high2026-06-08

CVE-2026-45416-Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

netty/netty · GHSA-x4gw-5cx5-pgmh