Security advisories

low2026-06-04

CVE-2026-47192-kas's late signature validation may allow unnoticed repository manipulations

siemens/kas · GHSA-4vqc-wpwg-vh7j

low2026-06-04

CVE-2026-10812-GPTCache: File and image cache keys collide because BufferedReader.peek() only reads the buffered prefix

zilliztech/gptcache · GHSA-xfqj-4cr9-9gr5

high2026-06-04

CVE-2026-34077-React Router vulnerable to Denial of Service via reflected user input in single-fetch

remix-run/react-router · GHSA-rxv8-25v2-qmq8

high2026-06-04

CVE-2026-45730-Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

nuclio/nuclio · GHSA-m8xg-8xg9-mxhm

high2026-06-04

CVE-2026-45337-Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

better-auth/better-auth · GHSA-cq3f-vc6p-68fh

medium2026-06-04

CVE-2026-45057-matrix-sdk-ui: Incomplete edit validation

matrix-org/matrix-rust-sdk · GHSA-h97m-27fx-42rx

medium2026-06-04

CVE-2026-45056-Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

matrix-org/matrix-rust-sdk · GHSA-wfq4-36m3-9g42

medium2026-06-04

CVE-2026-47707-Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

strawberry-graphql/strawberry · GHSA-fr49-mhgj-crfc

medium2026-06-04

CVE-2026-47706-Strawberry GraphQL has a Circular Fragment Reference DOS

strawberry-graphql/strawberry · GHSA-qfwv-87qj-98xq

medium2026-06-04

CVE-2026-44476-Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret

doorkeeper-gem/doorkeeper-openid_connect · GHSA-m6vc-f87m-cc2h

medium2026-06-04

CVE-2026-44889-WebOb: Location header normalization during redirect leads to open redirect - again

pylons/webob · GHSA-fh3h-vg37-cc95

high2026-06-04

CVE-2026-44496-Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

axios/axios · GHSA-hfxv-24rg-xrqf

high2026-06-04

CVE-2026-44488-Allocation of Resources Without Limits or Throttling in Axios

axios/axios · GHSA-777c-7fjr-54vf

high2026-06-04

CVE-2026-44487-Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

axios/axios · GHSA-p92q-9vqr-4j8v

high2026-06-04

CVE-2026-44486-Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

axios/axios · GHSA-j5f8-grm9-p9fc

medium2026-06-04

CVE-2026-48710-Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

kludex/starlette · GHSA-86qp-5c8j-p5mr

low2026-06-04

CVE-2026-10804-Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission

streamlit/streamlit · GHSA-vqwp-45wm-r9r5

low2026-06-04

CVE-2026-10803-MLflow: Deterministic sampling in dataset digest enables predictable collisions

mlflow/mlflow · GHSA-5qmp-p3c4-72qj

low2026-06-04

CVE-2026-10802-Keystone: GraphQL API Endpoint Lacks Query Depth Limits

keystonejs/keystone · GHSA-45jq-c8xm-jfw9

low2026-06-04

CVE-2026-10801-ms-swift: Image Cache Hash Collision via Missing Dimension Metadata

modelscope/ms-swift · GHSA-prfw-69r3-wqxf