Security advisories

high2026-05-19

CVE-2026-46373-SQLFluff: Recursive Stack Overflow in Parser

sqlfluff/sqlfluff · GHSA-wmhf-fqc8-vxhh

high2026-05-19

CVE-2026-46372-SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

sillytavern/sillytavern · GHSA-qg89-qwwh-5f3j

high2026-05-19

CVE-2026-46378-Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal

tomwright/dasel · GHSA-m6xr-fvfg-5g64

high2026-05-19

CVE-2026-46377-Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

tomwright/dasel · GHSA-m5j3-4634-c2vq

high2026-05-19

CVE-2026-45783-@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

libp2p/js-libp2p · GHSA-32mq-hpph-xfvr

critical2026-05-19

CVE-2026-46354-Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

coder/coder · GHSA-6x44-w3xg-hqqf

low2026-05-19

CVE-2026-46342-Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

nuxt/nuxt · GHSA-g8wj-3cr3-6w7v

medium2026-05-19

CVE-2026-46338-Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

facelessuser/pymdown-extensions · GHSA-62q4-447f-wv8h

high2026-05-19

CVE-2026-45805-PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

penpot/penpot · GHSA-22qr-rp27-j9wm

medium2026-05-19

CVE-2026-45802-FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

setasign/fpdi · GHSA-2mgw-7q6p-8grg

high2026-05-19

CVE-2026-45799-Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

square/wire · GHSA-7xpr-hc2w-34m9

medium2026-05-19

CVE-2026-45796-Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint

coder/coder · GHSA-686c-7vgv-v3fx

medium2026-05-19

CVE-2026-46357-HAX CMS: Denial of Service using Malicious Import Request

haxtheweb/issues · GHSA-9r33-xhw8-4qqp

medium2026-05-19

CVE-2026-45785-OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle

openmcdf/openmcdf · GHSA-5qwm-7pvp-w988

medium2026-05-19

CVE-2026-45784-rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

rust-openssl/rust-openssl · GHSA-phqj-4mhp-q6mq

medium2026-05-19

CVE-2026-45773-Turbo: Login callback CSRF/session fixation

vercel/turborepo · GHSA-hcf7-66rw-9f5r

low2026-05-19

CVE-2026-45772-Turbo: Unexpected local code execution during Yarn Berry detection

vercel/turborepo · GHSA-3qcw-2rhx-2726

critical2026-05-19

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

kuadrant/mcp-gateway · GHSA-g53w-w6mj-hrpp

medium2026-05-19

Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`

diesel-rs/diesel · GHSA-m9p2-fxp5-v3fp

medium2026-05-19

Diesel: Possible unaligned data access for implementations of `SqliteAggregate`

diesel-rs/diesel · GHSA-q8x8-jrhj-fh9p