Security advisories

low2026-05-15

CVE-2026-4053-Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields

mattermost/mattermost · GHSA-hw87-6jcq-9f8q

medium2026-05-15

CVE-2026-45619-AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`

wwbn/avideo · GHSA-c3ch-22rq-xfwr

medium2026-05-15

CVE-2026-45610-AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA

wwbn/avideo · GHSA-3mv2-vmwh-rwfx

medium2026-05-15

CVE-2026-45580-AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute

wwbn/avideo · GHSA-m5j4-7r85-2cj2

high2026-05-15

CVE-2026-45578-AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

wwbn/avideo · GHSA-xw67-cg5f-4m2r

high2026-05-15

CVE-2026-45575-Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client

oviva-ag/epa4all-client · GHSA-gqx7-6552-67hf

medium2026-05-15

CVE-2026-23695-Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option

cockpit-hq/cockpit · GHSA-ch4j-vcf5-58x5

high2026-05-15

CVE-2026-35194-Apache Flink: Remote code execution via SQL injection in code generation

apache/flink · GHSA-2f54-v4hm-fx73

high2026-05-15

CVE-2026-45574-epa4all-client: TLS Certificate Validation Disabled in Production

oviva-ag/epa4all-client · GHSA-5hhf-xmfx-4vvr

medium2026-05-15

CVE-2026-46383-Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`

microsoft/apm · GHSA-mq5j-pw29-jcv3

high2026-05-15

AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin

wwbn/avideo · GHSA-qxvm-r42f-5p8j

medium2026-05-15

arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS

arnika-project/arnika · GHSA-rc6v-5rmx-w5mv

medium2026-05-15

rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution

rkyv/rkyv · GHSA-vfvv-c25p-m7mm

high2026-05-15

CVE-2026-46491-SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion

simplesamlphp/simplesamlphp-module-casserver · GHSA-jrrg-99xh-5j2q

high2026-05-15

CVE-2026-44692-Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint

code16/sharp · GHSA-748w-hm6r-qc7v

high2026-05-15

CVE-2026-45717-Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL

budibase/budibase · GHSA-44m2-crh7-f4q2

high2026-05-15

CVE-2026-45715-Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration

budibase/budibase · GHSA-fgqv-jh4g-pvg2

high2026-05-15

CVE-2026-45548-Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation

budibase/budibase · GHSA-rpj4-7x2v-wjrf

high2026-05-15

CVE-2026-45364-Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation

better-auth/better-auth · GHSA-p6v2-xcpg-h6xw

medium2026-05-15

Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE

better-auth/better-auth · GHSA-wxw3-q3m9-c3jr