Security advisories

high2026-05-15

goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request

patrickhener/goshs · GHSA-mxg3-432p-mr72

medium2026-05-15

CVE-2026-45106-Weblate: Stored HTML injection in editor search preview

weblateorg/weblate · GHSA-6wxc-8mgq-w26m

high2026-05-15

CVE-2026-45062-FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

php/frankenphp · GHSA-3g8v-8r37-cgjm

high2026-05-15

CVE-2026-44716-Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator

pipecat-ai/pipecat · GHSA-3363-2ph6-35wh

high2026-05-15

CVE-2026-41147-NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class

nukeviet/nukeviet · GHSA-64rr-pp78-62ww

high2026-05-15

CVE-2026-40092-nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT

nimiq/core-rs-albatross · GHSA-27w2-87xv-37c6

high2026-05-15

CVE-2026-22810-@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files

laurent22/joplin · GHSA-gcmj-c9gg-9vh6

medium2026-05-15

CVE-2025-65954-SimpleSAMLphp casserver: Open Redirect in logout

simplesamlphp/simplesamlphp-module-casserver · GHSA-cvrm-5hp6-h523

high2026-05-15

CVE-2026-38728-smtp-server's command parser memory exhaustion denial-of-service

nodemailer/smtp-server · GHSA-fv2f-rw9f-v9cm

high2026-05-15

CVE-2026-2652-MLflow: unauthenticated access to certain FastAPI routes

mlflow/mlflow · GHSA-75cm-x2w3-8mgf

critical2026-05-14

CVE-2026-8634-Crabbox: environment variable exposure vulnerability

openclaw/crabbox · GHSA-fm77-94qm-4894

high2026-05-14

CVE-2026-8621-Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers

openclaw/crabbox · GHSA-4g9m-rffv-h6wq

critical2026-05-14

CVE-2026-45411-vm2 Has a Sandbox Breakout Using Async Generator

patriksimek/vm2 · GHSA-248r-7h7q-cr24

high2026-05-14

CVE-2026-45370-python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

universal-tool-calling-protocol/python-utcp · GHSA-5v57-8rxj-3p2r

critical2026-05-14

CVE-2026-45369-utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

universal-tool-calling-protocol/python-utcp · GHSA-33p6-5jxp-p3x4

high2026-05-14

CVE-2026-46509-@ranfdev/deepobj has a Prototype Pollution vulnerability

ranfdev/deepobj · GHSA-x7q7-fchv-8h2j

medium2026-05-14

CVE-2026-45366-@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

universal-tool-calling-protocol/typescript-utcp · GHSA-r8j5-8747-88cm

medium2026-05-14

slack-go `SecretsVerifier` accepts empty signing secret without precondition

slack-go/slack · GHSA-gxhx-2686-5h9g

critical2026-05-14

CVE-2026-45288-Marten has an injection vulnerability in its full-text search regConfig parameter

jasperfx/marten · GHSA-vmw2-qwm8-x84c

critical2026-05-14

@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation

samanhappy/mcphub · GHSA-wf8q-wvv8-p8jf