Security advisories

high2026-05-29

CVE-2026-41236-Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path

froxlor/froxlor · GHSA-mq5v-pxpm-8jw2

high2026-05-29

CVE-2026-41235-Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

froxlor/froxlor · GHSA-gcv3-5v9q-fmhh

high2026-05-29

CVE-2026-48501-GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands

cli/cli · GHSA-8xvp-7hj6-mcj9

high2026-05-29

CVE-2026-48527-HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint

haxtheweb/issues · GHSA-g2g8-95qg-v35h

medium2026-05-29

CVE-2026-49299-OpenStack Neutron has an Incorrect Authorization issue

openstack/neutron · GHSA-xv24-hxh9-2hh9

medium2026-05-28

tuf has platform-dependent delegation path matching

theupdateframework/python-tuf · GHSA-qp9x-wp8f-qgjj

high2026-05-28

CVE-2026-47179-Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives

getarcaneapp/arcane · GHSA-c3px-h233-h6fq

high2026-05-28

CVE-2026-42563-Dulwich Vulnerable to Command Injection via Merge Driver Path

jelmer/dulwich · GHSA-9277-mp7x-85jf

high2026-05-28

CVE-2026-42305-Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows

jelmer/dulwich · GHSA-897w-fcg9-f6xj

medium2026-05-28

CVE-2026-44394-OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token

openstack/keystone · GHSA-whqr-fgm5-x77q

medium2026-05-28

CVE-2026-43000-OpenStack Keystone has an Incorrect Authorization issue

openstack/keystone · GHSA-q623-f4j4-p4xj

medium2026-05-28

CVE-2026-42998-OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential

openstack/keystone · GHSA-8f8m-wrvr-wcvf

medium2026-05-28

CVE-2026-42999-OpenStack Keystone has an Authorization Bypass

openstack/keystone · GHSA-2r23-2g6v-2m5f

high2026-05-28

CVE-2026-5394-Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save

pimcore/pimcore · GHSA-r2f4-ff2p-xc64

medium2026-05-28

CVE-2026-47718-FUXA provides guest and invalid-token access to protected read APIs in secure mode

frangoteam/fuxa · GHSA-r9g5-7q8j-958c

medium2026-05-28

CVE-2026-47144-Shamefile has an arbitrary file read via shamefile.yaml in shame next

bkddfs/shamefile · GHSA-x6p3-76f2-xxvh

medium2026-05-28

CVE-2026-47128-nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

always-further/nono · GHSA-27vp-2mmc-vmh3

low2026-05-28

CVE-2026-46644-symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

symfony/polyfill · GHSA-2xf4-cg6j-vhgq

medium2026-05-28

CVE-2026-46526-local-deep-research has an SSRF bypass in `safe_get`

learningcircuit/local-deep-research · GHSA-g23j-2vwm-5c25

high2026-05-28

CVE-2026-46439-compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

oscal-compass/compliance-trestle · GHSA-gg2g-p7xc-qqmm