Security advisories

medium2026-06-04

CVE-2026-50183-WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section

wwbn/avideo · GHSA-66q5-cj5g-wrfx

medium2026-06-04

CVE-2026-50182-WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

wwbn/avideo · GHSA-hgjh-6wj8-gcgf

high2026-06-04

CVE-2026-49279-WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)

wwbn/avideo · GHSA-2fhx-q92v-5fhv

high2026-06-04

CVE-2026-47696-WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint

wwbn/avideo · GHSA-9392-pj54-qqf8

medium2026-06-04

CVE-2026-47694-WWBN AVideo: Stored XSS via unescaped Gallery category description

wwbn/avideo · GHSA-c8h8-vq34-9fw2

medium2026-06-04

Spree: CSV Formula Injection in Customer Export

spree/spree · GHSA-xf4v-w5x5-pv79

medium2026-06-04

CVE-2026-8462-OpenMeter: SQL injection through meter creation

openmeterio/openmeter · GHSA-wc3v-3457-c8cm

low2026-06-04

CVE-2026-50266-OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks

openstack/neutron · GHSA-qmc5-gv6v-8p22

critical2026-06-04

CVE-2026-50076-Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path

apache/fory · GHSA-8f39-v287-78jf

low2026-06-04

CVE-2026-10814-milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery

milvus-io/milvus · GHSA-jh6h-v6mp-h22v

high2026-06-04

CVE-2026-44393-OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake

openstack/oslo.messaging · GHSA-76qh-xr7q-h39m

low2026-06-04

CVE-2026-10813-LMCache: 16-bit multimodal hash collision can poison KV cache entries

lmcache/lmcache · GHSA-3hh9-752g-5g22

medium2026-06-04

CVE-2026-47676-Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

honojs/hono · GHSA-2gcr-mfcq-wcc3

medium2026-06-04

CVE-2026-47674-Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

honojs/hono · GHSA-xrhx-7g5j-rcj5

medium2026-06-04

CVE-2026-47675-Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

honojs/hono · GHSA-3hrh-pfw6-9m5x

medium2026-06-04

CVE-2026-47673-Hono: JWT middleware accepts any Authorization scheme, not only Bearer

honojs/hono · GHSA-f577-qrjj-4474

medium2026-06-04

CVE-2026-47672-epa4all-client: Unauthenticated REST API for Patient Record Writes

oviva-ag/epa4all-client · GHSA-c82x-f4xr-qv33

medium2026-06-04

CVE-2026-47671-Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets

nhost/nhost · GHSA-64cj-qvx5-m4f3

high2026-06-04

Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS)

klever-io/klever-go · GHSA-74m6-4hjp-7226

medium2026-06-04

CVE-2026-47215-Singluarity: Incorrect path matching for 'limit container paths' directive

sylabs/singularity · GHSA-wqcr-7rf3-f64m