Security advisories

medium2026-05-18

CVE-2026-45359-ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

imagemagick/imagemagick · GHSA-vhrh-72hq-w8m7

medium2026-05-18

CVE-2026-45719-Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API

budibase/budibase · GHSA-363w-hvwh-w7m6

high2026-05-18

CVE-2026-41567-Docker: `PUT /containers/{id}/archive` executes container binary on the host

moby/moby · GHSA-x86f-5xw2-fm2r

medium2026-05-18

CVE-2026-45718-Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows

budibase/budibase · GHSA-3263-v5v9-xq8q

high2026-05-18

CVE-2026-45716-Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration

budibase/budibase · GHSA-c54j-xp92-wh28

high2026-05-18

CVE-2026-45707-n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete

czlonkowski/n8n-mcp · GHSA-jxx9-px88-pj69

high2026-05-18

CVE-2026-8159-multiparty vulnerable to ReDoS via filename parsing

pillarjs/multiparty · GHSA-65x3-rw7q-gx94

high2026-05-18

CVE-2026-8162-multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing

pillarjs/multiparty · GHSA-xh3c-6gcq-g4rv

high2026-05-18

CVE-2026-8161-multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception

pillarjs/multiparty · GHSA-qxch-whhj-8956

low2026-05-18

Sulu: Used API Keys may be available via Admin API

sulu/sulu · GHSA-9m6v-8fxc-4r44

medium2026-05-18

CVE-2026-45701-Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

sulu/sulu · GHSA-7fv8-6pp7-6h85

high2026-05-18

CVE-2026-45363-ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351

jwt/ruby-jwt · GHSA-c32j-vqhx-rx3x

critical2026-05-18

CVE-2026-45697-Formie: Pre-authenticated server-side template injection in Hidden fields

verbb/formie · GHSA-x7m9-mwc2-g6w2

high2026-05-18

CVE-2026-45327-TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

datanoisetv/tinyice · GHSA-p7c4-8x34-8j8f

high2026-05-18

CVE-2026-45325-@tmlmobilidade/utils has prototype pollution in its setValueAtPath

tmlmobilidade/go · GHSA-cmxg-94mg-jq94

low2026-05-18

CVE-2026-2728-LibreNMS: Cross-Site Scripting in ShowConfigController

librenms/librenms · GHSA-5gm9-622f-qcg5

high2026-05-18

dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport

nubo-db/dynoxide · GHSA-fvh2-gm75-j4j7

high2026-05-18

CVE-2026-45302-parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names

milamer/parse-nested-form-data · GHSA-xp7r-j8r6-j9h3

high2026-05-18

CVE-2026-45300-async-http-client: Cookie header not stripped on cross-origin redirect

asynchttpclient/async-http-client · GHSA-fmxf-pm6p-7xgm

high2026-05-18

CVE-2026-45298-Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

amir20/dozzle · GHSA-3v9w-6365-9w54