Security advisories

low2026-05-19

CVE-2026-45803-GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

cli/cli · GHSA-crc3-h8v6-qh57

medium2026-05-19

Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching

caddyserver/caddy · GHSA-gx7w-56w6-g48x

medium2026-05-19

Caddy CVE-2026-30852 Fix Bypass

caddyserver/caddy · GHSA-wwhq-w58m-w29c

medium2026-05-19

Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation

kong/kubernetes-ingress-controller · GHSA-m23h-6mwm-39m8

medium2026-05-19

Kong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpoint

kong/kubernetes-ingress-controller · GHSA-3278-c88v-xrh4

high2026-05-19

CVE-2026-39806-Bandit: Unauthenticated DoS via chunked request trailers in Bandit HTTP/1 decoder

mtrudel/bandit · GHSA-rf5q-vwxw-gmrf

high2026-05-19

CVE-2026-39803-Bandit: Unauthenticated one-shot DoS via `Transfer-Encoding: chunked`

mtrudel/bandit · GHSA-9q9q-324x-93r2

critical2026-05-19

CVE-2026-46339-9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

decolua/9router · GHSA-fhh6-4qxv-rpqj

critical2026-05-19

CVE-2026-45695-Kopia: RCE via SSH ProxyCommand Injection

kopia/kopia · GHSA-2q4c-3mrw-63c3

high2026-05-19

CVE-2026-6009-Jaspersoft Reports: Java Deserialization Vulnerability Lleads to Remote Code Execution (RCE)

jaspersoft/jasperreports · GHSA-9wxq-mwqw-8hhg

high2026-05-19

CVE-2026-31069-BillaBear is Vulnerable to SQL Injection in the EventRepository

billabear/billabear · GHSA-xp6r-8pcc-xv5p

critical2026-05-19

CVE-2026-31072-APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

agronholm/apscheduler · GHSA-9cfw-f3f9-7mm7

medium2026-05-19

CVE-2026-46341-Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

apify/apify-mcp-server · GHSA-jwp7-wg77-3w9v

high2026-05-19

CVE-2026-46426-Budibase: Unrestricted Upload of File with Dangerous Type

budibase/budibase · GHSA-82rc-gxrg-v4gf

medium2026-05-19

CVE-2026-46424-Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour

budibase/budibase · GHSA-6vp2-6r7m-2jvx

medium2026-05-19

CVE-2026-46337-AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`

wwbn/avideo · GHSA-w4qq-74h6-58wq

medium2026-05-19

CVE-2026-45740-protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

protobufjs/protobuf.js · GHSA-jggg-4jg4-v7c6

high2026-05-19

libcrux-ml-dsa: Signature Verification on AVX2 Platforms Mishandles Edge Case

cryspen/libcrux · GHSA-fhvh-vw7h-9xf3

high2026-05-19

libcrux: Potential Panic on Overlong Ciphertext Buffer

cryspen/libcrux · GHSA-hc3c-63hc-2r9f

medium2026-05-19

Envoy AI Proxy - MCP Message Smuggling Vulnerability

envoyproxy/ai-gateway · GHSA-4gph-2hhr-5mwg