Security advisories

low2026-06-08

CVE-2026-11481-grepai Uses a Broken or Risky Cryptographic Algorithm

yoanbernabeu/grepai · GHSA-q76h-p6jh-9rw3

low2026-06-08

CVE-2026-11477-hsweb-framework has an open redirect issue

hs-web/hsweb-framework · GHSA-fxr3-gvm4-m8vc

low2026-06-08

CVE-2026-11479-grepai Uses a Broken or Risky Cryptographic Algorithm

yoanbernabeu/grepai · GHSA-6h35-9p2w-3j3r

low2026-06-08

CVE-2026-11470-hsweb-framework has a Path Traversal issue

hs-web/hsweb-framework · GHSA-vjmr-f5fc-vr2w

low2026-06-08

CVE-2026-11465-songquanpeng one-api has an issue that results in business logic errors

songquanpeng/one-api · GHSA-7v3v-cp44-vc8m

low2026-06-08

CVE-2026-11466-zilliztech deep-searcher has an Incorrect Privilege Assignment issue

zilliztech/deep-searcher · GHSA-43px-gpwc-q84v

high2026-06-05

CVE-2026-47732-Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points

twigphp/twig · GHSA-pr2w-4gpj-cpq4

low2026-06-05

CVE-2026-47730-Twig: XSS in profiler HtmlDumper via unescaped template and profile names

twigphp/twig · GHSA-2g2g-8p8h-fgwm

medium2026-06-05

CVE-2026-53954-Bugsink: DOS using large numbers of event tags

bugsink/bugsink · GHSA-5x67-j5xg-c5gj

medium2026-06-05

CVE-2026-47728-Bugsink: Project scoping missing in sourcemap and debug-file lookup

bugsink/bugsink · GHSA-5389-f7vh-wxj8

low2026-06-05

CVE-2026-47716-Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known

bugsink/bugsink · GHSA-g5vc-q7qc-v939

low2026-06-05

CVE-2026-47715-Bugsink: Issue event views can show an event from another project if its UUID is known

bugsink/bugsink · GHSA-vx2f-6m6h-9frf

high2026-06-05

CVE-2026-24425-Twig: Possible sandbox bypass when using a source policy

twigphp/twig · GHSA-2q52-x2ff-qgfr

critical2026-06-05

CVE-2026-47744-Shopper: Authorization bypass and RBAC privilege escalation in team settings

shopperlabs/shopper · GHSA-c3qp-2ggw-xjg7

high2026-06-05

CVE-2026-47743-Shopper: Multiple data integrity and disclosure issues in admin Livewire components

shopperlabs/shopper · GHSA-hr9v-r8r2-hg7j

medium2026-06-05

CVE-2026-47745-Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables

shopperlabs/shopper · GHSA-fxqw-97cc-7g5c

medium2026-06-05

CVE-2026-47742-Shopper: Missing authorization on Product admin Livewire sub-form components

shopperlabs/shopper · GHSA-h4mp-g9c6-xwph

high2026-06-05

CVE-2026-47761-TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

tinymce/tinymce · GHSA-vg35-5wq7-3x7w

high2026-06-05

CVE-2026-47762-TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

tinymce/tinymce · GHSA-v98h-vmpc-fpqv

high2026-06-05

CVE-2026-47759-TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

tinymce/tinymce · GHSA-q742-qvgc-gc2f