Security advisories

high2026-06-05

CVE-2026-47760-TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

tinymce/tinymce · GHSA-mh5m-5hw4-5c69

high2026-06-05

skillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion

umanio-agency/skillctl · GHSA-wx3m-whqv-xv47

critical2026-06-05

CVE-2026-47731-NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)

nasa-ammos/ait-core · GHSA-p462-prxw-mjx4

medium2026-06-05

CVE-2026-54533-vantage6 node has an Improper Access Control issue

vantage6/vantage6 · GHSA-x9f6-9rvm-mmrg

medium2026-06-05

CVE-2026-54445-Vantage6: Set admin user and password from environment or configuration

vantage6/vantage6 · GHSA-fgmc-2hqj-86v4

medium2026-06-05

CVE-2026-53926-NocoDB: OAuth Tokens Persist Through Security Events

nocodb/nocodb · GHSA-g72g-r7m4-9x4g

high2026-06-05

CVE-2026-52878-Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt

klever-io/klever-go · GHSA-rm5c-5x2p-48wr

high2026-06-05

CVE-2026-52880-klever-go: REST API slow-header connection exhaustion via Gin Engine.Run

klever-io/klever-go · GHSA-w4c6-7r69-w7j9

high2026-06-05

CVE-2026-52879-klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS

klever-io/klever-go · GHSA-hf2g-6j7h-98wg

medium2026-06-05

CVE-2026-49343-Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS

klever-io/klever-go · GHSA-fw38-pc54-jvx9

high2026-06-05

CVE-2026-48017-DbGate: Remote Code Execution via functionName injection in loadReader endpoint

dbgate/dbgate · GHSA-hv83-ggc4-v385

high2026-06-05

CVE-2026-47684-Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP

sync-in/server · GHSA-q4x5-8cj6-52wg

medium2026-06-05

CVE-2026-47680-Source controller: Improper path handling allows traversal

fluxcd/source-controller · GHSA-jjrm-hr5f-673x

critical2026-06-05

CVE-2026-47670-Authenticated Remote Code Execution via loadReader functionName code injection in DbGate

dbgate/dbgate · GHSA-wm5r-5qp3-5vxf

high2026-06-05

CVE-2026-47419-praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

mervinpraison/praisonai · GHSA-7p8g-6c6g-h9w7

critical2026-06-05

CVE-2026-47669-DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE

dbgate/dbgate · GHSA-h535-j5hr-mv56

critical2026-06-05

CVE-2026-47668-DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

dbgate/dbgate · GHSA-8v3q-9vmx-36vc

low2026-06-05

CVE-2026-47388-NocoDB: Missing Ownership Check in MCP Attachment Read

nocodb/nocodb · GHSA-xxpj-q764-9r6q

high2026-06-05

CVE-2026-47387-NocoDB: Stored Cross-Site Scripting via Form View Redirect URL

nocodb/nocodb · GHSA-hj85-ph9q-78jg

medium2026-06-05

CVE-2026-47386-NocoDB: OAuth Authorization Code Race Condition

nocodb/nocodb · GHSA-8m7c-hf24-5g47