Security advisories

low2026-05-18

Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML

sveltia/sveltia-cms · GHSA-97r8-rf7q-wmjw

high2026-05-18

CVE-2026-45135-Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

caddyserver/caddy · GHSA-m675-2p33-xv9g

medium2026-05-18

CVE-2026-6402-webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

webpack/webpack-dev-server · GHSA-79cf-xcqc-c78w

medium2026-05-18

CVE-2026-45620-AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`

wwbn/avideo · GHSA-vpfx-pxqw-2w79

high2026-05-18

CVE-2026-45609-Spring AI MCP Security: Unvalidated URL Fetching (SSRF)

spring-ai-community/mcp-security · GHSA-qjp4-4jvr-xqg3

high2026-05-18

CVE-2026-46510-form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys

kaspernj/form-data-objectizer · GHSA-m2hg-wjq3-28wq

high2026-05-18

Graphite Has a Pickle Deserialization Vulnerability

mkh-user/graphite · GHSA-qw48-84f6-28gv

medium2026-05-18

CVE-2026-45582-n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters

czlonkowski/n8n-mcp · GHSA-f3rg-xqjj-cj9w

high2026-05-18

CVE-2026-45539-Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree

microsoft/apm · GHSA-q5pp-gvjg-h7v4

high2026-05-18

iskorotkov/avro: Denial-of-Service Vulnerability in Decoder

iskorotkov/avro · GHSA-mx64-mj3q-7prj

critical2026-05-18

CVE-2026-7302-SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability

sgl-project/sglang · GHSA-qwrp-wghp-94q2

critical2026-05-18

CVE-2026-7301-SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket

sgl-project/sglang · GHSA-gwv6-pq6m-p3rq

critical2026-05-18

CVE-2026-7304-SGLang: Unauthenticated RCE via --enable-custom-logit-processor

sgl-project/sglang · GHSA-36m8-w8qf-g76p

medium2026-05-18

CVE-2026-6339-Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint

mattermost/mattermost · GHSA-xvcx-mgpc-5xh3

medium2026-05-18

CVE-2026-6345-Mattermost doesn't prevent disclosure of created user password

mattermost/mattermost · GHSA-wvgv-4fc3-2rcp

medium2026-05-18

CVE-2026-28732-Mattermost doesn't enforce slash command trigger-word uniqueness during command updates

mattermost/mattermost · GHSA-wvcv-9xpm-7mqc

low2026-05-18

CVE-2026-6333-Mattermost doesn't validate the Host header when constructing response URLs for custom slash command

mattermost/mattermost · GHSA-vqp5-2mrp-qqxg

medium2026-05-18

CVE-2026-6343-Mattermost doesn't check public/private permissions

mattermost/mattermost · GHSA-m79q-8qf5-v622

low2026-05-18

CVE-2026-4286-Mattermost doesn't check if {{team_id}} was being changed when updating playbooks

mattermost/mattermost · GHSA-gvg4-jhmr-6j23

high2026-05-18

CVE-2026-6346-Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation

mattermost/mattermost · GHSA-9p64-jpc7-m2rp