Security advisories

medium2026-05-13

CVE-2025-64526-Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying

strapi/strapi · GHSA-7mqx-wwh4-f9fw

critical2026-05-13

CVE-2026-45375-SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

siyuan-note/siyuan · GHSA-27qc-m5gf-jv5r

high2026-05-13

CVE-2026-45371-SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs

siyuan-note/siyuan · GHSA-gmmv-4cc5-wr9r

high2026-05-13

Anchor: `InterfaceAccount` allows account substitution between unexpected types

solana-foundation/anchor · GHSA-429q-fhh4-r6hj

medium2026-05-13

wger has an Uncontrolled Resource Consumption issue

wger-project/wger · GHSA-v25j-wqcw-fvhj

critical2026-05-13

CVE-2026-45083-Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy

intranda/goobi-viewer-core · GHSA-2rgp-f66f-4499

high2026-05-13

CVE-2026-45152-uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution

uniget-org/cli · GHSA-qqq4-5773-pmw5

medium2026-05-13

CVE-2026-45148-SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode

siyuan-note/siyuan · GHSA-fmh9-gpqh-g53g

medium2026-05-13

CVE-2026-45147-SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

siyuan-note/siyuan · GHSA-6r88-8v7q-q4p2

critical2026-05-13

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server

obot-platform/obot · GHSA-vw82-7fv8-r6gp

high2026-05-13

CVE-2026-45137-Anchor: Program<'info, System> is not properly validated

solana-foundation/anchor · GHSA-c6rc-8jpp-2fgc

high2026-05-13

CVE-2026-45136-claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh

cnighswonger/claude-code-cache-fix · GHSA-g3xq-3gmv-qq8g

high2026-05-13

CVE-2026-44798-Nautobot: GitRepository.current_head field should not be writable through REST API

nautobot/nautobot · GHSA-p3hx-pwf3-j8wr

high2026-05-13

CVE-2026-44797-Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

nautobot/nautobot · GHSA-c35q-vxrp-ph26

medium2026-05-13

CVE-2026-44796-Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

nautobot/nautobot · GHSA-qrpw-gjvh-x5gm

medium2026-05-13

CVE-2026-44794-Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

nautobot/nautobot · GHSA-wpxj-44w3-2j6x

medium2026-05-13

CVE-2026-44774-Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

traefik/traefik · GHSA-96qj-4jj5-wcjc

medium2026-05-13

CVE-2026-44740-go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

go-git/go-billy · GHSA-m3xc-h892-ggx6

high2026-05-13

CVE-2026-44738-Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

getgrav/grav · GHSA-j274-39qw-32c9

high2026-05-13

CVE-2026-45134-LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

langchain-ai/langsmith-sdk · GHSA-3644-q5cj-c5c7