Security advisories

medium2026-05-18

CVE-2026-47741-shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption

shopperlabs/shopper · GHSA-9rh9-hf3w-9fgg

high2026-05-18

CVE-2026-47740-shopper/framework: Authorization bypass in multiple Livewire admin components

shopperlabs/shopper · GHSA-f946-9qp6-vgch

high2026-05-18

CVE-2026-46385-iskorotkov/avro: CPU Exhaustion in Decoder

iskorotkov/avro · GHSA-w8j3-pq8g-8m7w

high2026-05-18

CVE-2026-45270-CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

ci4-cms-erp/ci4ms · GHSA-gqr2-7hcg-rchf

high2026-05-18

CVE-2026-46384-iskorotkov/avro: Integer Overflow in Decoder

iskorotkov/avro · GHSA-mc57-h6j3-3hmv

medium2026-05-18

CVE-2026-45149-brace-expansion: Large numeric range defeats documented `max` DoS protection

juliangruber/brace-expansion · GHSA-jxxr-4gwj-5jf2

medium2026-05-18

CVE-2026-45139-CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations

ci4-cms-erp/ci4ms · GHSA-245j-xjvr-xvm5

medium2026-05-18

CVE-2026-45138-CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule

ci4-cms-erp/ci4ms · GHSA-2m69-jmvh-6chr

medium2026-05-18

Microsoft DirectX12: .spritefont multiply overflow only in 32-bit builds

microsoft/directxtk12 · GHSA-5r97-79vw-qvm4

medium2026-05-18

Microsoft DirectX: .spritefont multiply overflow only in 32-bit builds

microsoft/directxtk · GHSA-c55g-rp4x-fx84

high2026-05-18

eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges

edumfa/edumfa · GHSA-j5rm-v3vh-vx94

high2026-05-18

eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage

edumfa/edumfa · GHSA-qq2p-4282-cfc5

medium2026-05-18

eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check

edumfa/edumfa · GHSA-74r7-3mjm-jc5v

medium2026-05-18

CVE-2026-45660-Statamic CMS: Server-Side Request Forgery via Glide

statamic/cms · GHSA-pf9c-ch8r-2958

medium2026-05-18

CVE-2026-42326-ImageMagick: Heap Buffer Over-Read in IPTC encoder

imagemagick/imagemagick · GHSA-7wff-wpr6-vmhm

low2026-05-18

CVE-2026-33637-Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping

lostisland/faraday · GHSA-5rv5-xj5j-3484

medium2026-05-18

CVE-2026-45577-Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass

markmhendrickson/neotoma · GHSA-5cvp-p7p4-mcx9

high2026-05-18

CVE-2026-45627-Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover

getarcaneapp/arcane · GHSA-q2pj-8v84-9mh5

medium2026-05-18

CVE-2026-45626-Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter

getarcaneapp/arcane · GHSA-9mvm-4gwg-v8mp

critical2026-05-18

CVE-2026-45625-Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

getarcaneapp/arcane · GHSA-7h26-hg47-p9hx