Security advisories

medium2026-05-27

CVE-2026-45068-Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

symfony/symfony · GHSA-xx3c-qf5g-hc39

high2026-05-27

CVE-2026-45067-Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

symfony/symfony · GHSA-qpmx-3rfj-7rhv

medium2026-05-27

CVE-2026-45066-Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

symfony/symfony · GHSA-qc95-4862-92fh

medium2026-05-27

CVE-2026-45064-Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

symfony/symfony · GHSA-h5vq-qfcg-4m6p

high2026-05-27

CVE-2026-44982-CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

crowdsecurity/crowdsec · GHSA-rw47-hm26-6wr7

medium2026-05-27

CVE-2026-44981-CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression

crowdsecurity/crowdsec · GHSA-273h-gvwr-c3qj

high2026-05-27

CVE-2026-44726-Deno's TLS retry copies stale upgrade hook, risking plaintext traffic

denoland/deno · GHSA-chqv-56wv-7564

critical2026-05-27

CVE-2026-25879-Langroid has Prompt to SQL Injection, Leading to RCE

langroid/langroid · GHSA-mxfr-6hcw-j9rq

critical2026-05-27

CVE-2026-45618-LiquidJS is Vulnerable to Remote Code Execution

harttle/liquidjs · GHSA-gf2q-c269-pqgc

high2026-05-27

CVE-2026-45617-LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

harttle/liquidjs · GHSA-r7g9-xpmj-5fcq

high2026-05-27

CVE-2026-45368-Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

getkirby/kirby · GHSA-qvjf-922g-pj44

high2026-05-27

CVE-2026-45357-LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)

harttle/liquidjs · GHSA-hh27-hf48-9f5q

medium2026-05-27

CVE-2026-45334-Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions

getkirby/kirby · GHSA-39vq-49qm-r2mc

high2026-05-27

CVE-2026-45260-Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

pimcore/pimcore · GHSA-wc7j-g8wx-m2qx

high2026-05-27

CVE-2026-45162-Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

pimcore/pimcore · GHSA-36fc-7wjg-mfvj

medium2026-05-27

CVE-2026-45065-Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

symfony/symfony · GHSA-72xp-p242-47p9

high2026-05-27

CVE-2026-45063-Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator

symfony/symfony · GHSA-ph86-p8f6-f9r2

medium2026-05-27

CVE-2026-9674-Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability

jenkinsci/jenkins-multijob-plugin · GHSA-hj3h-r49w-34wh

low2026-05-27

CVE-2026-9712-pretix vulnerable to Authorization Bypass Through User-Controlled Key

pretix/pretix · GHSA-72p9-6vv6-gvqh

medium2026-05-27

CVE-2026-48927-Jenkins buildgraph-view Plugin does not escape the build URL

jenkinsci/buildgraph-view-plugin · GHSA-43ph-42gv-7965