Security advisories

high2026-05-27

CVE-2026-45725-compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal

oscal-compass/compliance-trestle · GHSA-g3vg-vx23-3858

high2026-05-27

CVE-2026-47717-FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

frangoteam/fuxa · GHSA-q3w6-q3hc-c5x6

high2026-05-27

CVE-2026-47243-Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

kata-containers/kata-containers · GHSA-2gv2-cffp-j227

critical2026-05-27

CVE-2026-46621-Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection

yamcs/yamcs · GHSA-2g95-6x5q-xjwj

critical2026-05-27

CVE-2026-46562-Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override

yamcs/yamcs · GHSA-vmwp-vh32-rj75

high2026-05-27

CVE-2026-45704-Pimcore has a CustomReports Share Bypass

pimcore/pimcore · GHSA-jwcc-gv4m-93x6

medium2026-05-27

CVE-2026-45703-Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export

pimcore/pimcore · GHSA-332x-r494-54fq

medium2026-05-27

CVE-2026-45309-AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

ronf/asyncssh · GHSA-g794-3fmp-753h

low2026-05-27

CVE-2026-45305-Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

symfony/symfony · GHSA-9frc-8383-795m

low2026-05-27

CVE-2026-45304-Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

symfony/symfony · GHSA-4qpc-3hr4-r2p4

low2026-05-27

CVE-2026-45133-Symfony hardened the parser when handling untrusted input

symfony/symfony · GHSA-c2p3-7m5p-cv8x

high2026-05-27

CVE-2026-45332-Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint

marcantondahmen/automad · GHSA-xm76-r88j-vm3g

high2026-05-27

CVE-2026-45077-Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

symfony/symfony · GHSA-m7v2-7gxm-vc2v

high2026-05-27

CVE-2026-45075-Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

symfony/symfony · GHSA-6439-2f28-8p8q

medium2026-05-27

CVE-2026-45074-Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

symfony/symfony · GHSA-j8gj-9rm5-4xhx

medium2026-05-27

CVE-2026-45073-Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

symfony/symfony · GHSA-6qh9-h6wf-jgqc

low2026-05-27

CVE-2026-45072-Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

symfony/symfony · GHSA-hmr5-2xcr-v8pp

low2026-05-27

CVE-2026-45071-Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

symfony/symfony · GHSA-x6g4-fwcc-jj8w

medium2026-05-27

CVE-2026-45070-Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names

symfony/symfony · GHSA-vqc8-7275-q272

medium2026-05-27

CVE-2026-45069-Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

symfony/symfony · GHSA-29fc-p6c4-24cg