Security advisories

medium2026-05-23

CVE-2026-47120-Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)

nezhahq/nezha · GHSA-rxf6-wjh4-jfj6

high2026-05-23

CVE-2026-46717-Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification

nezhahq/nezha · GHSA-w4g9-mxgg-j532

medium2026-05-22

CVE-2026-46715-Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

pallets-eco/flask-security · GHSA-97r5-pg8x-p63p

high2026-05-22

CVE-2026-70646-aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

vovchic17/aiosend · GHSA-7m8f-hgjq-8gc9

medium2026-05-22

CVE-2026-8723-qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

ljharb/qs · GHSA-q8mj-m7cp-5q26

critical2026-05-22

CVE-2026-48777-FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory

gtsteffaniak/filebrowser · GHSA-qqqm-5547-774x

critical2026-05-22

CVE-2026-46670-YesWiki: Unauthenticated SQL Injection

yeswiki/yeswiki · GHSA-jwvv-qr7q-cv8j

medium2026-05-22

CVE-2026-47166-ImageMagick: Heap Buffer Over-Read in distributed pixel cache server

imagemagick/imagemagick · GHSA-6gxq-f64p-5w6f

medium2026-05-22

CVE-2026-47165-ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model

imagemagick/imagemagick · GHSA-2rgj-gx5x-f62w

medium2026-05-22

CVE-2026-46693-ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking

imagemagick/imagemagick · GHSA-4g75-9r48-jf92

medium2026-05-22

CVE-2026-46692-ImageMagick: Heap Buffer Over-Write in distributed pixel cache server

imagemagick/imagemagick · GHSA-p93h-f2jc-477j

low2026-05-22

CVE-2026-8415-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder

concretecms/concretecms · GHSA-xj25-753j-wgp9

low2026-05-22

CVE-2026-8410-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete

concretecms/concretecms · GHSA-v7c7-658v-hh7v

low2026-05-22

CVE-2026-8412-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache

concretecms/concretecms · GHSA-rv3q-xmfw-mcjv

low2026-05-22

CVE-2026-8416-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)

concretecms/concretecms · GHSA-qj94-6rx6-27fr

low2026-05-22

CVE-2026-8413-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design

concretecms/concretecms · GHSA-mpq2-mv8p-9wm6

medium2026-05-22

CVE-2026-8245-Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination

concretecms/concretecms · GHSA-f73j-pm2c-rxvr

low2026-05-22

CVE-2026-8414-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate

concretecms/concretecms · GHSA-98qf-jvwj-2r5f

low2026-05-22

CVE-2026-8432-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()

concretecms/concretecms · GHSA-97jw-gr4m-c5v8

medium2026-05-22

CVE-2026-8337-Concrete CMS is vulnerable to IDOR in surveys

concretecms/concretecms · GHSA-8c7c-h7px-267g