Security advisories

high2026-05-13

CVE-2026-44724-Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

sebhildebrandt/systeminformation · GHSA-hvx9-hwr7-wjj9

medium2026-05-13

CVE-2026-44720-OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover

th30d4y/openlearnx · GHSA-223g-f5mq-gw33

low2026-05-13

CVE-2026-45028-Astro: Server island encrypted parameters vulnerable to cross-component replay

withastro/astro · GHSA-xr5h-phrj-8vxv

high2026-05-13

CVE-2026-44697-Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload

klever-io/klever-go · GHSA-87m7-qffr-542v

medium2026-05-13

CVE-2026-44681-Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect

authlib/authlib · GHSA-r95x-qfjj-fjj2

critical2026-05-13

CVE-2026-44672-Mapfish Print: Remote Code Injection (RCE) in Dynamic table

mapfish/mapfish-print · GHSA-q7m6-wpvf-mvwx

high2026-05-12

CVE-2026-44660-UltraJSON has a Memory Leak in ujson.dump() on Write Failure

ultrajson/ultrajson · GHSA-c38f-wx89-p2xg

medium2026-05-12

CVE-2026-44652-SillyTavern has a SSRF vulnerability in the CORS proxy middleware

sillytavern/sillytavern · GHSA-ccfq-2454-f5xw

medium2026-05-12

CVE-2026-44651-SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware

sillytavern/sillytavern · GHSA-xc4x-2452-5gc9

critical2026-05-12

CVE-2026-44650-SillyTavern has a Path Traversal issue

sillytavern/sillytavern · GHSA-886q-f44j-h6wh

critical2026-05-12

CVE-2026-44649-SillyTavern has Authentication Bypass via SSO Header Injection

sillytavern/sillytavern · GHSA-gxx6-h3g6-vwjh

high2026-05-12

CVE-2026-44648-SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

sillytavern/sillytavern · GHSA-wmm3-h9qj-p5v6

high2026-05-12

CVE-2026-44594-esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files

esm-dev/esm.sh · GHSA-rg65-45m7-hq57

high2026-05-12

CVE-2026-44593-esm.sh: Legacy Route Path Traversal Can Lead to RCE

esm-dev/esm.sh · GHSA-3636-h3vx-6465

medium2026-05-12

CVE-2026-8052-HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack

hashicorp/nomad-driver-exec2 · GHSA-wqwc-x3rc-2xw6

high2026-05-12

CVE-2026-7474-HashiCorp Nomad vulnerable to a path traversal

hashicorp/nomad · GHSA-hx53-77qj-8663

medium2026-05-12

CVE-2026-6959-HashiCorp Nomad vulnerable to symlink attack

hashicorp/nomad · GHSA-3934-423w-4jq3

critical2026-05-12

CVE-2026-33117-Security feature bypass vulnerability in Azure Key Vault Keys library for Java

azure/azure-sdk-for-java · GHSA-97jf-46m3-8953

critical2026-05-12

CVE-2026-31238-Ludwig framework is vulnerable to insecure deserialization in its model serving component

ludwig-ai/ludwig · GHSA-xp5q-5q7g-q26r

critical2026-05-12

CVE-2026-31237-Ludwig framework is vulnerable to insecure deserialization through its predict() method.

ludwig-ai/ludwig · GHSA-wcr3-gm9f-f87q