Security advisories

critical2026-05-12

CVE-2026-45321-Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

tanstack/router · GHSA-g7cv-rxg3-hmpx

medium2026-05-11

CVE-2026-8319-aiwaves-cn agents is vulnerable to resource consumption in the recall_relevant_memories_to_working_memory function

aiwaves-cn/agents · GHSA-ch88-c67q-65r9

high2026-05-11

CVE-2026-2614-MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

mlflow/mlflow · GHSA-42h5-h8qh-vv9v

high2026-05-11

CVE-2026-7790- cowlib cow_http_te module: Uncontrolled Resource Consumption vulnerability allows Excessive Allocation

ninenines/cowlib · GHSA-32p9-57cr-4x65

medium2026-05-11

CVE-2026-45222-@steipete/summarize allows local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json

steipete/summarize · GHSA-qp7v-gjgg-4mj6

medium2026-05-11

CVE-2026-43968-ninenines cowlib: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability allows SSE event splitting and injection via unvalidated field values

ninenines/cowlib · GHSA-hv23-4qp7-8c8r

low2026-05-11

CVE-2026-43969-cowlib: Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

ninenines/cowlib · GHSA-g2wm-735q-3f56

medium2026-05-11

CVE-2026-45224-Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution

openclaw/crabbox · GHSA-3cjv-h753-qf7h

medium2026-05-11

CVE-2026-45046-Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content

safedep/gryph · GHSA-f3jg-756w-gm35

high2026-05-11

CVE-2026-44657-MantisBT Vulnerable to Stored XSS in File Download

mantisbt/mantisbt · GHSA-p6fr-rxq7-xcg8

high2026-05-11

CVE-2026-44655-MantisBT has Stored XSS on Move Attachments Admin Page

mantisbt/mantisbt · GHSA-7mqj-8gj2-cg59

high2026-05-11

CVE-2026-44635-Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`

kysely-org/kysely · GHSA-pv5w-4p9q-p3v2

medium2026-05-11

CVE-2026-43979-local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)

learningcircuit/local-deep-research · GHSA-fj2m-qvh9-jq4q

critical2026-05-11

CVE-2026-43898-SandboxJS has a sandbox escape via Function.caller leakage of internal call op

nyariv/sandboxjs · GHSA-g8f2-4f4f-5jqw

high2026-05-11

CVE-2026-42071-MantisBT has a Private Bugnote Attachment Content Leak via REST API

mantisbt/mantisbt · GHSA-pw5x-2mf9-3xc8

medium2026-05-11

CVE-2026-42070-MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API

mantisbt/mantisbt · GHSA-pq86-j2c2-47f6

medium2026-05-11

CVE-2026-41897-MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field

mantisbt/mantisbt · GHSA-j7v9-f46r-2rp4

medium2026-05-11

CVE-2026-41159-Mermaid: Improper sanitization of configuration leads to CSS injection

mermaid-js/mermaid · GHSA-87f9-hvmw-gh4p

medium2026-05-11

CVE-2026-41150-Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

mermaid-js/mermaid · GHSA-6m6c-36f7-fhxh

medium2026-05-11

CVE-2026-41149-Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

mermaid-js/mermaid · GHSA-ghcm-xqfw-q4vr