Security advisories

medium2026-05-21

CVE-2026-8205-Concrete CMS is vulnerable to authorization bypass in the Calendar Block

concretecms/concretecms · GHSA-46xh-7854-f568

high2026-05-21

CVE-2026-47102-LiteLLM allows a user to modify their own user_role via the /user/update endpoint

berriai/litellm · GHSA-wpfp-gwwc-vwq6

high2026-05-21

CVE-2026-8140-Concrete CMS is Vulnerable to Cross-Site Request Forgery

concretecms/concretecms · GHSA-r42c-3rr2-jrfp

high2026-05-21

CVE-2026-8135-Concrete CMS Vulnerable to Deserialization of Untrusted Data

concretecms/concretecms · GHSA-pv2v-6w2v-97x6

high2026-05-21

CVE-2026-8197-Concrete CMS is vulnerable to Stored XSS via OAuth integration name

concretecms/concretecms · GHSA-h72c-xx3w-w8h7

critical2026-05-21

CVE-2026-8134-Concrete CMS Vulnerable to Relative Path Traversal

concretecms/concretecms · GHSA-645j-cm4x-3xvw

medium2026-05-21

CVE-2026-6826-Concrete CMS is vulnerable to unauthenticated file usage disclosure

concretecms/concretecms · GHSA-4g7q-44qp-cc5c

high2026-05-21

CVE-2026-47101-LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit

berriai/litellm · GHSA-qrc4-49gv-mv9m

medium2026-05-21

CVE-2026-46638-Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

twigphp/twig · GHSA-7fxw-r6jv-74c8

low2026-05-21

CVE-2026-46637-Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

twigphp/twig · GHSA-jv8m-2544-3pg3

low2026-05-21

CVE-2026-46635-Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)

twigphp/twig · GHSA-vcc8-phrv-43wj

medium2026-05-21

CVE-2026-46634-Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name

twigphp/twig · GHSA-24x9-r6q4-q93w

critical2026-05-21

CVE-2026-46633-Twig: PHP code injection via `{% use %}` template name

twigphp/twig · GHSA-7p85-w9px-jpjp

low2026-05-21

CVE-2026-46629-twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments

twigphp/twig · GHSA-35wc-cvqg-78fp

low2026-05-21

CVE-2026-46628-Twig: The `spaceless` filter implicitly marks its output as safe

twigphp/twig · GHSA-4j38-f5cw-54h7

high2026-05-21

CVE-2026-46625-JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

js-cookie/js-cookie · GHSA-qjx8-664m-686j

high2026-05-21

CVE-2026-46673-Russh: Unchecked CryptoVec allocation and growth handling is reachable

eugeny/russh · GHSA-g9f8-wqj9-fjw5

high2026-05-21

@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails

kerberosmansour/hulumi · GHSA-59f3-7227-wmh4

critical2026-05-21

@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators

kerberosmansour/hulumi · GHSA-q2f7-m237-v562

high2026-05-21

@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies

kerberosmansour/hulumi · GHSA-4xrh-5m3m-328w