Security advisories

high2026-05-27

CVE-2026-44741-Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

pimcore/pimcore · GHSA-h4ph-crvj-9h92

high2026-05-27

CVE-2026-44739-Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration

pimcore/pimcore · GHSA-3234-gxc3-pq6f

high2026-05-27

CVE-2026-44705-tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape

raszi/node-tmp · GHSA-ph9p-34f9-6g65

medium2026-05-27

CVE-2026-44646-LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

harttle/liquidjs · GHSA-9x9p-qf8f-mvjg

medium2026-05-27

CVE-2026-44645-LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

harttle/liquidjs · GHSA-8xx9-69p8-7jp3

medium2026-05-27

CVE-2026-44644-LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS

harttle/liquidjs · GHSA-2qv6-9wx5-cwv4

critical2026-05-27

CVE-2026-44632-Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`

yamcs/yamcs · GHSA-524g-x36v-9wm6

medium2026-05-27

CVE-2026-44596-Yamcs has No Rate Limiting on Authentication Endpoint

yamcs/yamcs · GHSA-w5r6-mcgq-7pq4

medium2026-05-27

CVE-2026-44595-Yamcs vulnerable to unauthorized user enumeration via IAM API endpoints

yamcs/yamcs · GHSA-p2rj-mrmc-9w29

medium2026-05-27

CVE-2026-44587-CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

carrierwaveuploader/carrierwave · GHSA-7g26-2qgj-chfg

medium2026-05-26

CVE-2026-44210-Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

kata-containers/kata-containers · GHSA-rr59-xxvx-96qr

high2026-05-26

CVE-2026-44177-Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup

getkirby/kirby · GHSA-9hx7-c53c-v6x8

medium2026-05-26

CVE-2026-44176-Kirby CMS's `pages.access` permission is not checked during rendering of page drafts

getkirby/kirby · GHSA-2xw4-v2wx-hqq9

high2026-05-26

CVE-2026-44175-Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend

getkirby/kirby · GHSA-5fhx-9q32-q257

high2026-05-26

CVE-2026-44174-Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints

getkirby/kirby · GHSA-86rh-h242-j8xp

high2026-05-26

CVE-2026-43947-FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

frangoteam/fuxa · GHSA-rg3m-cfq7-g6h6

high2026-05-26

CVE-2026-43946-FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

frangoteam/fuxa · GHSA-fwcm-rqvw-j3p7

high2026-05-26

CVE-2026-43945-FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

frangoteam/fuxa · GHSA-p69w-mmfv-xrfj

medium2026-05-26

CVE-2026-42568-Yamcs Vulnerable to LDAP Injection in LdapAuthModule

yamcs/yamcs · GHSA-cqh3-jg8p-336j

high2026-05-26

CVE-2026-42462-Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

fedify-dev/fedify · GHSA-9rfg-v8g9-9367