Security advisories

low2026-05-20

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

opentofu/opentofu · GHSA-pxh5-6rrc-8rjv

high2026-05-20

CVE-2026-8468-Plug: Unbounded buffer accumulation in multipart header parsing causes denial of service

elixir-plug/plug · GHSA-468c-vq7p-gh64

medium2026-05-20

CVE-2026-46431-Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

xyproto/algernon · GHSA-hw27-4v2q-5qff

medium2026-05-20

CVE-2026-46430-Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS

xyproto/algernon · GHSA-gj84-924c-48fx

critical2026-05-20

CVE-2026-46421- Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

cap-js/cds-dbs · GHSA-pvw4-cvr4-97p8

medium2026-05-20

Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions

shivammathur/setup-php · GHSA-5wxr-w449-57cm

medium2026-05-20

CVE-2026-46420-Setup PHP: Command Injection in Repository-Derived PHP Version Resolution

shivammathur/setup-php · GHSA-pqwm-q9pv-ph8r

high2026-05-20

CVE-2026-45804-Diffusers: TOCTOU Trust Remote Code Bypass

huggingface/diffusers · GHSA-7wx4-6vff-v64p

medium2026-05-20

CVE-2026-45792-RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM

rtk-ai/rtk · GHSA-fvvm-949w-qj4w

medium2026-05-20

CVE-2026-6366-Drupal core allows Object Injection

drupal/core · GHSA-xmjc-63pr-2mpg

medium2026-05-20

CVE-2026-6367-Drupal core allows Cross-Site Scripting (XSS)

drupal/core · GHSA-pw6f-3999-xp7g

medium2026-05-20

CVE-2026-6365-Drupal core is Vulnerable to Cross-Site Scripting

drupal/core · GHSA-f3cj-mjqm-fhvj

medium2026-05-19

CVE-2026-42526-Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

apache/airflow · GHSA-g9qc-qf28-hhqx

high2026-05-19

CVE-2026-27173-Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

apache/airflow · GHSA-524w-vq63-2xhf

high2026-05-19

CVE-2026-46417-@angular/platform-server: SSRF via Hostname Hijacking

angular/angular · GHSA-rfh7-fxqc-q52v

high2026-05-19

CVE-2026-46415-Caddy Defender trusted proxy client IP bypass

jasonlovesdoggo/caddy-defender · GHSA-3h23-rrpc-3p87

critical2026-05-19

CVE-2026-46412-Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

beproduct/beproduct-org-nestjs-auth · GHSA-6xwp-cp5h-q856

high2026-05-19

CVE-2026-46410-FileBrowser Quantum: unauthenticated user share share info

gtsteffaniak/filebrowser · GHSA-3jmg-p96m-m328

high2026-05-19

CamoFox MCP: Unauthenticated HTTP MCP browser-control surface

redf0x1/camofox-mcp · GHSA-7hgr-7h44-33w2

high2026-05-19

CVE-2026-46374-SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser

sqlfluff/sqlfluff · GHSA-73jc-5mrq-prw7