Security Advisories

medium2026-10-23

FastMCP: Post-transform component authorization is skipped on direct calls

medium2026-10-23

FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

prefecthq/fastmcp · GHSA-vqqp-x5qm-5qp4

high2026-10-23

vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)

vllm-project/vllm · GHSA-gx7p-2j49-hfq4 · CVE-2026-114055

low2026-10-23

SvelteKit: URL redirection to untrusted site via enhanced form submission

sveltejs/kit · GHSA-pfhg-q3qv-9q6r · CVE-2026-114060

medium2026-10-23

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

go-chi/chi · GHSA-j6qf-3m9c-vwj3 · CVE-2026-114437

medium2026-10-23

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

githubnewbie0/odf-kit · GHSA-2rqm-h6hv-g79v

high2026-10-23

pypdf: Possible long runtimes for repeated references to the same missing object

py-pdf/pypdf · GHSA-6c7f-9265-g8fw · CVE-2026-115572

high2026-10-23

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

py-pdf/pypdf · GHSA-jr96-gvgh-j3r4 · CVE-2026-115585

high2026-10-23

pypdf: Possible long runtimes for large xref table header limits

py-pdf/pypdf · GHSA-gmh7-3g9r-mjh5 · CVE-2026-115580

medium2026-10-23

Tokio: Race condition in `tokio::time::Interval`

tokio-rs/tokio · GHSA-5wjr-9356-4wc8 · CVE-2026-115567

high2026-10-23

Electron: Mitigation for compromised eMudhra intermediate certificates

electron/electron · GHSA-jr5w-w6x2-84p9 · CVE-2026-115570

high2026-10-23

body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

expressjs/body-parser · GHSA-27r3-jxmh-p828 · CVE-2026-111181

high2026-10-23

gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()

gitoxidelabs/gitoxide · GHSA-q54r-jf2p-rfr2

medium2026-10-23

Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

livewire/livewire · GHSA-mhf7-xp6r-6qrc

medium2026-10-23

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

labstack/echo · GHSA-h53f-rm2w-w7rg

high2026-10-23

Echo: WebSocket proxy can retain connections and handlers after client disconnect

labstack/echo · GHSA-9969-6676-49h5

high2026-10-23

Echo: Decompress permits unbounded gzip expansion in v4

labstack/echo · GHSA-h7wr-284f-5qvc

critical2026-10-23

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

labstack/echo · GHSA-cxf3-9h37-7rr8

medium2026-10-23

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

labstack/echo · GHSA-x9ff-22gv-65f4

high2026-10-23

Echo: BodyDump captures request and response bodies without size limits in v4

labstack/echo · GHSA-f48p-c9v4-h7xv