Security advisories

high2026-05-21

@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass

kerberosmansour/hulumi · GHSA-g43v-9x7q-83pq

high2026-05-21

@hulumi/drift: Orphan reconciler accepted externally supplied execute plans

kerberosmansour/hulumi · GHSA-2ffm-hxrq-qqmm

medium2026-05-21

@hulumi/baseline: CloudTrail selector tampering events were not fully detected

kerberosmansour/hulumi · GHSA-gfp8-mp24-5vxg

medium2026-05-21

CVE-2026-46609-Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

umbraco/umbraco-cms · GHSA-vr9v-27gg-qgx4

medium2026-05-21

CVE-2026-46556-FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

flaskbb/flaskbb · GHSA-xq32-9g7q-7297

low2026-05-21

CVE-2026-46554-NocoDB: Stale Auth Cache After API Token Deletion

nocodb/nocodb · GHSA-f76x-f9vj-92jv

low2026-05-21

CVE-2026-46553-NocoDB: Attachment Size Limit Bypass via Upload-by-URL

nocodb/nocodb · GHSA-8rwr-f68v-cvw6

medium2026-05-21

CVE-2026-46552-NocoDB: Shared-base link access can invite arbitrary users as persistent base members

nocodb/nocodb · GHSA-chqv-vrj7-qffp

medium2026-05-21

CVE-2026-46551-NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion

nocodb/nocodb · GHSA-99vc-2jx2-688p

medium2026-05-21

CVE-2026-46550-NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags

nocodb/nocodb · GHSA-f74w-272x-mqcv

low2026-05-21

CVE-2026-46549-NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation

nocodb/nocodb · GHSA-m5qg-rvjq-727p

medium2026-05-21

CVE-2026-46548-NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)

nocodb/nocodb · GHSA-2c5x-4jgf-88mj

medium2026-05-21

CVE-2026-46547-NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL

nocodb/nocodb · GHSA-9qgr-6vpg-9gh9

high2026-05-21

CVE-2026-46519-MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement

flux159/mcp-server-kubernetes · GHSA-cr22-wjx7-2w6m

low2026-05-21

CVE-2026-46668-SpiceDB: Caveat structures with nested lists can result in improper cache reuse

authzed/spicedb · GHSA-mqcf-gqvg-rmhm

high2026-05-21

CVE-2026-46654-Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

plonky3/plonky3 · GHSA-vj64-rjf3-w3v7

high2026-05-21

CVE-2026-46643-Snappy: Binary path is never shell-escaped due to an inverted is_executable check

knplabs/snappy · GHSA-vpr4-p6fq-85jc

medium2026-05-21

CVE-2026-46683-Snappy : SSRF and local file read via the xsl-style-sheet option

knplabs/snappy · GHSA-c5fp-p67m-gq56

medium2026-05-21

CVE-2026-46618-Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables

fission/fission · GHSA-7pjr-qpvh-m339

high2026-05-21

CVE-2026-46617-Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read

fission/fission · GHSA-85g2-pmrx-r49q