Security advisories

high2026-05-19

CVE-2025-70950-gohttp is vulnerable to directory traversal via a crafted request

itang/gohttp · GHSA-rg3p-p27c-2f39

high2026-05-19

CVE-2025-51427-ModelScope is vulnerable to arbitrary code injection via a crafted module

modelscope/modelscope · GHSA-fhhq-h4hg-549x

critical2026-05-19

CVE-2026-2586-GlassFish's Administration Console is Vulnerable to RCE

eclipse-ee4j/glassfish · GHSA-96v6-hq43-x9h4

critical2026-05-19

CVE-2026-2587-GlassFish's gadget handler is vulnerable to RCE

eclipse-ee4j/glassfish · GHSA-29wv-cv7p-xjc2

critical2026-05-19

CVE-2026-47323-Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering

apache/camel · GHSA-8364-hfqj-pwm6

low2026-05-19

CVE-2026-45570-go-git: Improper single-quote escaping in go-git SSH transport

go-git/go-git · GHSA-m7cr-m3pv-hgrp

critical2026-05-19

CVE-2026-45568-rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths

openziti/zrok · GHSA-jh67-hwqw-m5r7

high2026-05-19

CVE-2026-46511-HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

haxtheweb/issues · GHSA-x3x5-7h4h-gwxg

high2026-05-19

CVE-2026-46396-Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover

haxtheweb/issues · GHSA-jh3h-rpxg-fr36

critical2026-05-19

CVE-2026-46395-HAXcms: Private Key Disclosure via Broken HMAC Implementation

haxtheweb/issues · GHSA-6c8g-9hfh-pq5h

high2026-05-19

CVE-2026-46391-HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

haxtheweb/issues · GHSA-4fg7-f244-3j49

medium2026-05-19

CVE-2026-46496-HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

haxtheweb/issues · GHSA-2m6p-hm3w-6jm3

high2026-05-19

CVE-2026-46393-HAXcms createSite SSRF Enables Arbitrary File Read

haxtheweb/issues · GHSA-q862-gcgq-5m6g

medium2026-05-19

Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication

xyproto/algernon · GHSA-9v4j-7g44-qcqw

critical2026-05-19

CVE-2026-45721-Algernon: handler.lua discovery walks parent directories above the server root

xyproto/algernon · GHSA-xwcr-wm99-g9jc

high2026-05-19

CVE-2026-45728-Algernon: Single-file mode unconditionally enables debug mode

xyproto/algernon · GHSA-fwqx-8365-9983

high2026-05-19

Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString

scriban/scriban · GHSA-24c8-4792-22hx

critical2026-05-19

Malware in @opensearch-project/opensearch

opensearch-project/opensearch-js · GHSA-27f5-xjrr-q9ff

medium2026-05-19

CVE-2026-45409-Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

kjd/idna · GHSA-65pc-fj4g-8rjx

high2026-05-19

CVE-2026-7504-Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak

keycloak/keycloak · GHSA-rp95-xpg9-c2cq