Security advisories

high2026-05-12

CVE-2026-31225-Superduper: Remote code execution via unsafe eval in superduper query parsing

superduper-io/superduper · GHSA-2799-6g5r-mmc7

critical2026-05-12

CVE-2026-42074-OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input

gitlawb/openclaude · GHSA-m77w-p5jj-xmhg

medium2026-05-12

CVE-2026-42073-OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS

gitlawb/openclaude · GHSA-c73c-x77g-854r

medium2026-05-12

CVE-2026-32686-Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

ericmj/decimal · GHSA-rhv4-8758-jx7v

critical2026-05-12

CVE-2026-45091-sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

davidalmeidac/sealed-env · GHSA-x3r2-fj3r-g5mv

high2026-05-12

CVE-2026-45090-Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)

hahwul/dalfox · GHSA-2g4x-fq3j-cgq4

high2026-05-12

CVE-2026-45089-Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option

hahwul/dalfox · GHSA-8hf9-3q64-q2qf

high2026-05-12

CVE-2026-45088-Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`

hahwul/dalfox · GHSA-35wr-x7v6-9fv2

critical2026-05-12

CVE-2026-45087-Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

hahwul/dalfox · GHSA-v25v-m36w-jp4h

high2026-05-12

CVE-2026-44295-protobuf.js: Code injection in pbjs static output from crafted schema names

protobufjs/protobuf.js · GHSA-6r35-46g8-jcw9

medium2026-05-12

CVE-2026-44294-protobuf.js: Denial of service from crafted field names in generated code

protobufjs/protobuf.js · GHSA-2pr8-phx7-x9h3

high2026-05-12

CVE-2026-44293-protobuf.js: Code injection through bytes field defaults in generated toObject code

protobufjs/protobuf.js · GHSA-66ff-xgx4-vchm

medium2026-05-12

CVE-2026-44292-protobuf.js: Prototype injection in generated message constructors

protobufjs/protobuf.js · GHSA-fx83-v9x8-x52w

high2026-05-12

CVE-2026-44291-protobuf.js: Code generation gadget after prototype pollution

protobufjs/protobuf.js · GHSA-75px-5xx7-5xc7

high2026-05-12

CVE-2026-44290-protobuf.js: Process-wide denial of service through unsafe option paths

protobufjs/protobuf.js · GHSA-jvwf-75h9-cwgg

high2026-05-12

CVE-2026-44289-protobuf.js: Denial of service through unbounded protobuf recursion

protobufjs/protobuf.js · GHSA-685m-2w69-288q

medium2026-05-12

CVE-2026-44288-protobufjs has overlong UTF-8 decoding

protobufjs/protobuf.js · GHSA-q6x5-8v7m-xcrf

high2026-05-12

CVE-2026-42290-protobuf.js is Vulnerable to OS Command Injection in the CLI

protobufjs/protobuf.js · GHSA-f84p-cvgm-xgjj

high2026-05-12

CVE-2026-41713-Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor

spring-projects/spring-ai · GHSA-5852-phmh-8fhr

low2026-05-12

CVE-2026-8349-omec-project amf crashes when processing malformed LocationReports

omec-project/amf · GHSA-3h63-fx68-x5fm