Security advisories

medium2026-06-05

CVE-2024-27928-Vantage6: 2FA can be circumvented with hacked email access

vantage6/vantage6 · GHSA-4c5c-2vc3-x5w2

low2026-06-05

CVE-2024-24769-Vantage6: No limit on emails sent for password/MFA reset

vantage6/vantage6 · GHSA-5549-c5q7-fj65

high2026-06-05

CVE-2026-11332-ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution

ansible/ansible · GHSA-w8p5-mx5w-cpqj

medium2026-06-05

CVE-2026-10732-decompress: Arbitrary File Write via Archive Extraction (Zip Slip)

kevva/decompress · GHSA-h39j-r5qq-r9mm

low2026-06-05

CVE-2026-9088-Keycloak: Information disclosure due to user profile permission bypass

keycloak/keycloak · GHSA-6g26-7cx5-mrrg

low2026-06-05

CVE-2026-11312-bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map

bytedance/infinistore · GHSA-2vrg-7rqv-prf9

medium2026-06-05

CVE-2026-50589-OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash

openstack/ironic · GHSA-q3g8-rjrx-59ph

critical2026-06-04

CVE-2026-47708-MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

sepinetam/stata-mcp · GHSA-4p62-hqp5-g644

medium2026-06-04

CVE-2026-47703-AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle

adguardteam/adguardhome · GHSA-xgx4-4h9w-53pv

critical2026-06-04

Supply chain compromise via malicious @cap-js/openapi

cap-js/openapi · GHSA-jpvj-wpmj-h7rv

medium2026-06-04

CVE-2026-48013-Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

shopware/shopware · GHSA-gq96-5pfx-f4vc

medium2026-06-04

CVE-2026-48015-Shopware: Stored XSS via SVG file upload — no SVG sanitization

shopware/shopware · GHSA-xvhc-gm7j-mhmc

medium2026-06-04

CVE-2026-48016-Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

shopware/shopware · GHSA-9v5m-39wh-5chq

medium2026-06-04

CVE-2026-48014-Shopware: Admin API ACL Bypass in Order State Transition Endpoints

shopware/shopware · GHSA-f8q6-3g5w-jjr6

medium2026-06-04

CVE-2026-48012-Shopware SSO referer trust leading to an arbitrary redirect target

shopware/shopware · GHSA-4x3x-869w-xx3m

low2026-06-04

CVE-2026-48011-Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

shopware/shopware · GHSA-7w52-7jvm-m9vw

medium2026-06-04

CVE-2026-48010-Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

shopware/shopware · GHSA-v39m-97p8-gqg7

medium2026-06-04

CVE-2026-48009-Shopware: Admin Account Takeover via User Recovery Hash Exposure

shopware/shopware · GHSA-8v9p-g828-v98f

medium2026-06-04

CVE-2026-48008-Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

shopware/shopware · GHSA-gv8p-48fr-4fxg

critical2026-06-04

CVE-2026-54458-WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

wwbn/avideo · GHSA-8whc-2wmv-ww35