Security advisories

medium2026-05-26

CVE-2026-28735-Mattermost allows authenticated users to gain access to private repositories

mattermost/mattermost · GHSA-r5vf-grcx-5vqp

low2026-05-26

CVE-2026-8340-Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion

concretecms/concretecms · GHSA-xjg6-5v39-v7fc

low2026-05-26

CVE-2026-8353-Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme

concretecms/concretecms · GHSA-q9fm-mpg8-8jqm

low2026-05-26

CVE-2026-8347-Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog

concretecms/concretecms · GHSA-jqvq-gv67-3567

critical2026-05-26

CVE-2026-44930-Apache CXF has an LDAP injection vulnerability

apache/cxf · GHSA-pg32-686q-qh6x

high2026-05-26

CVE-2026-5740-Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation

mattermost/mattermost · GHSA-w9m8-p4cc-4qj9

medium2026-05-26

CVE-2026-44618-Apache CXF's WS-Transfer module has an insecure XML parser configuration

apache/cxf · GHSA-vmm5-fjgx-2jhp

medium2026-05-26

CVE-2026-4646-Mattermost doesn't validate user-supplied input in API request handlers

mattermost/mattermost · GHSA-rmvv-8v8w-rf7x

medium2026-05-26

CVE-2026-4635-Mattermost doesn't archive the channel before removing persistent notifications

mattermost/mattermost · GHSA-pg7c-462j-grxv

high2026-05-26

CVE-2026-5308-Mattermost doesn't enforce request body size limits on plugin HTTP endpoints

mattermost/mattermost · GHSA-jmvr-r5hm-fxfr

medium2026-05-26

CVE-2026-3636-Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions

mattermost/mattermost · GHSA-ffpr-pfr4-g354

high2026-05-26

CVE-2026-3473-Mattermost doesn't validate file ownership and access control

mattermost/mattermost · GHSA-7pf2-9c95-w332

medium2026-05-26

CVE-2026-5755-Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory

mattermost/mattermost · GHSA-37j2-3vv8-cf24

high2026-05-26

CVE-2026-44417-Apache CXF: Untrusted JMS configuration can lead to RCE

apache/cxf · GHSA-2hvc-5c6v-f533

medium2026-05-23

CVE-2026-47124-Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members

nezhahq/nezha · GHSA-hvv7-hfrh-7gxj

critical2026-05-23

CVE-2026-46716-Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

nezhahq/nezha · GHSA-99gv-2m7h-3hh9

high2026-05-23

CVE-2026-47125-Arcane: Missing admin authorization on global variables endpoint

getarcaneapp/arcane · GHSA-jpjh-jm2p-39hh

medium2026-05-23

instagrapi: Unsafe signup challenge path handling in instagrapi

subzeroid/instagrapi · GHSA-ggxf-37hm-9wqf

medium2026-05-23

CVE-2026-47157-aiograpi: Unsafe signup challenge path handling

subzeroid/aiograpi · GHSA-jh37-x3fv-4x72

high2026-05-23

CVE-2026-47138-Parse Server: Pre-authentication denial of service via client version header regex backtracking

parse-community/parse-server · GHSA-38m6-82c8-4xfm