Security advisories

high2026-05-26

CVE-2026-42089-yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

yeoman/environment · GHSA-vv9j-gjw2-j8wp

medium2026-05-26

CVE-2026-41207-netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

netty/netty-incubator-codec-ohttp · GHSA-f659-372h-6x3x

high2026-05-26

CVE-2026-48048-XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

xwiki/xwiki-platform · GHSA-rh28-mqj4-8x59

medium2026-05-26

CVE-2026-48047-XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

xwiki/xwiki-platform · GHSA-vgwr-23fq-pr7g

low2026-05-26

CVE-2026-35202-Pterodactyl has a database resource limit bypass via race condition in Client API

pterodactyl/panel · GHSA-fgmm-w5cx-vrfw

medium2026-05-26

CVE-2026-26028-CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS

cryptpad/cryptpad · GHSA-g2g4-47gv-p72v

critical2026-05-26

CVE-2026-33137-XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

xwiki/xwiki-platform · GHSA-qrvh-r3f2-9h4r

medium2026-05-26

CVE-2026-39964-Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers

baptistearno/typebot.io · GHSA-hqmv-v56g-4m47

high2026-05-26

CVE-2026-28445-Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview

baptistearno/typebot.io · GHSA-6m7c-xfhp-p9fh

critical2026-05-26

CVE-2026-23734-XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash

xwiki/xwiki-commons · GHSA-xq3r-2qv5-vqqm

medium2026-05-26

CVE-2025-66407-Weblate has a Server-Side Request Forgery issue

weblateorg/weblate · GHSA-hfpv-mc5v-p9mm

medium2026-05-26

CVE-2026-9540-vllm has Improper Resource Shutdown or Release

vllm-project/vllm · GHSA-98f3-hwg4-4rf7

critical2026-05-26

CVE-2026-7374-KubeVirt has a Link Following vulnerability

kubevirt/kubevirt · GHSA-7jcp-v9w4-wjmg

high2026-05-26

CVE-2026-9496-pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

npm/pacote · GHSA-w4pp-8pjf-rmxw

medium2026-05-26

CVE-2026-9495-@koa/router has an Access Control Bypass

koajs/router · GHSA-47p6-69vm-vw6v

low2026-05-26

CVE-2026-9520-Blitz has a Cross-site Scripting issue

blitz-js/blitz · GHSA-h2p9-cr4h-px24

medium2026-05-26

CVE-2026-44598-Apache Shiro Vulnerable to Open Redirect, Server-Side Request Forgery

apache/shiro · GHSA-wpqm-4gwx-w843

medium2026-05-26

CVE-2026-43827-Apache Shiro has a session fixation vulnerability

apache/shiro · GHSA-fcvm-3cpj-f9qx

medium2026-05-26

CVE-2026-43828-Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute

apache/shiro · GHSA-c6r4-qjmw-cvj2

low2026-05-26

CVE-2026-48589-Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login

apache/shiro · GHSA-7pq2-fhx9-x464