Security advisories

high2026-05-19

CVE-2026-45793-Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

composer/composer · GHSA-f9f8-rm49-7jv2

medium2026-05-19

CVE-2026-56348-n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass

n8n-io/n8n · GHSA-3875-8gcx-7v46

medium2026-05-19

n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions

n8n-io/n8n · GHSA-2vx9-7wpg-88jq

low2026-05-19

CVE-2026-45739-Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs

strawberry-graphql/strawberry · GHSA-x97m-qp5c-w9xj

high2026-05-19

CVE-2026-45738-Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

argoproj/argo-cd · GHSA-h98r-wv3h-fr38

medium2026-05-19

CVE-2026-45737-Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

argoproj/argo-cd · GHSA-rg3g-4rw9-gqrp

high2026-05-19

CVE-2026-45713-Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

axllent/mailpit · GHSA-fpxj-m5q8-fphw

medium2026-05-19

CVE-2026-45712-Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

axllent/mailpit · GHSA-w4vj-r5pg-3722

medium2026-05-19

CVE-2026-45711-Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

axllent/mailpit · GHSA-qx5x-85p8-vg4j

medium2026-05-19

CVE-2026-45709-Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer

axllent/mailpit · GHSA-j3fj-qppj-fmmc

medium2026-05-19

CVE-2026-45692-Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

caddyserver/caddy · GHSA-x5w9-xh9r-mvfc

medium2026-05-19

CVE-2026-45670-Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

nuxt/nuxt · GHSA-6m52-m754-pw2g

medium2026-05-19

CVE-2026-45669-Nuxt: Reflected XSS in `navigateTo()` external redirect

nuxt/nuxt · GHSA-fx6j-w5w5-h468

high2026-05-19

ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation

oras-project/oras-java · GHSA-xm96-gfjx-jcrc

high2026-05-19

auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs

ymw0407/auth-fetch-mcp · GHSA-hv85-774v-26fg

critical2026-05-19

CVE-2026-45758-Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

guardrails-ai/guardrails · GHSA-xmpw-2vmm-p4p6

medium2026-05-19

CVE-2026-45581-fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

hyperledger/fabric-chaincode-java · GHSA-wg5x-3g47-v38r

low2026-05-19

CVE-2026-45781-MCP Registry: OCI validator skips ownership check on upstream rate limits

modelcontextprotocol/registry · GHSA-2v5f-5r6w-p67r

high2026-05-19

CVE-2026-45576-zrok copy writes attacker-controlled WebDAV paths outside the destination root

openziti/zrok · GHSA-c656-jcx2-7pqj

medium2026-05-19

CVE-2026-45571-go-git: Crafted repositories may modify main and submodule .git directories

go-git/go-git · GHSA-crhj-59gh-8x96