Security advisories

high2026-06-03

CVE-2026-44016-Docling: Unsafe Playwright-based HTML Rendering

docling-project/docling · GHSA-pj2v-ggqh-cmq2

medium2026-06-03

CVE-2026-43980-malla: Stored XSS via Meshtastic node names in multiple frontend pages

zenitram/malla · GHSA-ch57-39q2-4crm

high2026-06-03

CVE-2026-42342-React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

remix-run/react-router · GHSA-8x6r-g9mw-2r78

high2026-06-03

CVE-2026-42211-React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

remix-run/react-router · GHSA-49rj-9fvp-4h2h

high2026-06-03

CVE-2026-41234-Froxlor: BIND Zone File Injection via TXT Record Content

froxlor/froxlor · GHSA-37m5-m4q3-fc6x

medium2026-06-03

CVE-2026-40898-quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

quic-go/quic-go · GHSA-vvgj-x9jq-8cj9

medium2026-06-03

CVE-2026-40181-React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

remix-run/react-router · GHSA-2j2x-hqr9-3h42

medium2026-06-03

CVE-2026-34993-AIOHTTP is Vulnerable to Deserialization of Untrusted Data

aio-libs/aiohttp · GHSA-jg22-mg44-37j8

high2026-06-03

CVE-2026-33245-React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

remix-run/react-router · GHSA-8646-j5j9-6r62

medium2026-06-03

CVE-2026-33244-React Router has stored XSS via unescaped Location header in prerendered redirect HTML

remix-run/react-router · GHSA-f22v-gfqf-p8f3

medium2026-06-03

CVE-2022-31114-backpack/crud is vulnerable to Cross-Site Scripting (XSS)

laravel-backpack/crud · GHSA-m8xx-3x29-84h8

high2026-06-03

CVE-2026-44017-Docling: Unsafe Zip Extraction in EasyOCR Model Download

docling-project/docling · GHSA-cjqg-rq2h-2fvj

high2026-06-03

CVE-2026-37462-GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function

osrg/gobgp · GHSA-pw7p-7fqv-hpj8

high2026-06-03

CVE-2024-52011-launch-editor vulnerable to command injection via the crafted request on Windows

vitejs/launch-editor · GHSA-c27g-q93r-2cwf

low2026-06-03

CVE-2026-44546-daphne: WebSocket handshake header smuggling through autobahn splitlines() mishandling of non-standard line separators

django/daphne · GHSA-xh68-hfp5-5x5m

low2026-06-03

CVE-2026-7666-Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake

django/django · GHSA-mm6v-q8q9-pgcf

low2026-06-03

CVE-2026-6873-Django: signed cookies are vulnerable to salt namespace collisions

django/django · GHSA-h7pc-vwp9-298g

high2026-06-03

CVE-2026-5241-huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

huggingface/transformers · GHSA-fgcw-684q-jj6r

low2026-06-03

CVE-2026-48587-Django: has_vary_header may expose cached responses when Vary values contain whitespace

django/django · GHSA-923m-gv2p-w5qp

low2026-06-03

CVE-2026-8404-Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

django/django · GHSA-8cjm-8mp7-r2xf