Security advisories

critical2026-06-08

CVE-2026-45034-PHPSpreadsheet has a patch bypass for CVE-2026-34084

phpoffice/phpspreadsheet · GHSA-87m4-826x-3crx

high2026-06-08

CVE-2026-44894-Netty's Default QUIC token handler accepts any client-supplied token

netty/netty · GHSA-cmm3-54f8-px4j

high2026-06-08

CVE-2026-44893-Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

netty/netty · GHSA-cc37-9q2j-3hfv

high2026-06-08

CVE-2026-44892-Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size

netty/netty · GHSA-c2rx-5r8w-8xr2

high2026-06-08

CVE-2026-44890-Netty has Unbounded Direct Memory Consumption in its RedisDecoder

netty/netty · GHSA-6ghj-frrj-jjj3

high2026-06-08

CVE-2026-44250-Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

netty/netty · GHSA-3244-j874-rhc2

high2026-06-08

CVE-2026-44249-Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

netty/netty · GHSA-3qp7-7mw8-wx86

medium2026-06-08

CVE-2026-43966-cowboy and gun affected by an HTTP Request/Response Splitting vulnerability

ninenines/cowlib · GHSA-w4f7-4cxr-rv3c

low2026-06-08

CVE-2026-11529-MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler

designcomputer/mysql-mcp-server · GHSA-mvq4-39wx-6h5g

medium2026-06-08

CVE-2026-42890-actual Allows Electron to Run As Node

actualbudget/actual · GHSA-7rvm-xjpp-63r9

medium2026-06-08

CVE-2026-41479-Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type

authlib/authlib · GHSA-w8p2-r796-3vmq

high2026-06-08

CVE-2026-43973-gun has an Uncontrolled Resource Consumption vulnerability

ninenines/gun · GHSA-r53j-fjj5-mv77

high2026-06-08

CVE-2026-49234-Routinator crashes when sending a maliciously crafted select-asn query parameter

nlnetlabs/routinator · GHSA-gc6q-cwcj-3vh9

high2026-06-08

CVE-2026-49235-Routinator crashes when encountering maliciously crafted RRDP XML files

nlnetlabs/routinator · GHSA-5qf9-cf9c-hjc6

high2026-06-08

CVE-2026-49233-Routinator has cache path traversal when processing the module component of rsync URIs

nlnetlabs/routinator · GHSA-33mj-99mg-8g73

high2026-06-08

CVE-2026-43974-gun has an Unexpected Status Code or Return Value vulnerability

ninenines/gun · GHSA-2j82-37xg-f9wp

medium2026-06-08

CVE-2026-43972-gun_http2 has an Origin Validation Error vulnerability

ninenines/gun · GHSA-36w4-95hv-5vwg

medium2026-06-08

CVE-2026-39922-GeoNode contains a server-side request forgery vulnerability in the service registration endpoint

geonode/geonode · GHSA-hw9r-6m78-w6h3

critical2026-06-08

CVE-2026-47430-Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.

apache/cordova-plugin-inappbrowser · GHSA-q42j-x8rq-pjg6

low2026-06-08

CVE-2026-11500-Weaviate has an Improper Authorization issue

weaviate/weaviate · GHSA-jqpm-wf57-qx5c