Security advisories

critical2026-05-21

CVE-2026-46614-Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger

fission/fission · GHSA-3g33-6vg6-27m8

high2026-05-21

CVE-2026-46612-Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives

fission/fission · GHSA-chf8-4hv6-8pg6

medium2026-05-21

CVE-2026-46616-Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

umbraco/umbraco-cms · GHSA-2qjj-h6wp-c7h7

medium2026-05-21

CVE-2026-46561-pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API

pyload/pyload · GHSA-8rp3-xc6w-5qp5

high2026-05-21

CVE-2026-46545-nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item

nimiq/core-rs-albatross · GHSA-mw3q-r9wh-h2ff

medium2026-05-21

CVE-2026-46543-nimiq-blockchain: Genesis batch set request

nimiq/core-rs-albatross · GHSA-vghx-352f-93jm

medium2026-05-21

CVE-2026-46542-nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points

nimiq/core-rs-albatross · GHSA-h9cc-w26m-j342

medium2026-05-21

CVE-2026-46539-nimiq-primitives: BlockInclusionProof interlink issue when hops are empty

nimiq/core-rs-albatross · GHSA-799f-29jm-gr6c

high2026-05-21

CVE-2026-46517-lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out

internlm/lmdeploy · GHSA-9xq9-36w5-q796

low2026-05-21

CVE-2026-46497-Crawlee for Python: SSRF via sitemap-derived URLs

apify/crawlee-python · GHSA-3r75-xc34-5f44

critical2026-05-21

CVE-2026-48207-Apache Fory PyFory Deserialization of Untrusted Data

apache/fory · GHSA-m5gw-83w2-7749

medium2026-05-21

@sveltejs/kit: `query.batch` cross-talk

sveltejs/kit · GHSA-hgv7-v322-mmgr

high2026-05-21

CVE-2026-46492-md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)

commenthol/md-fileserver · GHSA-32q2-hhr5-6qvv

medium2026-05-21

CVE-2026-8597-Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler

aws/sagemaker-python-sdk · GHSA-rq6v-x3j8-7qgf

high2026-05-21

CVE-2026-8596-Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path

aws/sagemaker-python-sdk · GHSA-7hh5-prp2-mfh5

high2026-05-21

CVE-2026-46432-LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization

internlm/lmdeploy · GHSA-m549-qq94-fvhg

high2026-05-21

CVE-2026-46490-samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions

tngan/samlify · GHSA-34r5-q4jw-r36m

low2026-05-21

androidqf: APK download Path Traversal in device APK paths

mvt-project/androidqf · GHSA-763j-3p5v-jfc6

low2026-05-21

androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers)

mvt-project/androidqf · GHSA-jf2q-463c-6f52

medium2026-05-21

CVE-2026-46486-Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing

mvt-project/mvt · GHSA-5h3g-px23-w6vw