Security advisories

medium2026-05-11

CVE-2026-41148-Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection

mermaid-js/mermaid · GHSA-xcj9-5m2h-648r

high2026-05-11

CVE-2026-40607-MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column

mantisbt/mantisbt · GHSA-f633-865q-2mhh

medium2026-05-11

CVE-2026-40598-MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page

mantisbt/mantisbt · GHSA-6jh4-47v2-4g37

high2026-05-11

CVE-2026-40597-MantisBT has a Content Security Policy bypass via attachments

mantisbt/mantisbt · GHSA-9c3j-xm6v-j7j3

high2026-05-11

CVE-2026-40596-MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference

mantisbt/mantisbt · GHSA-j3v9-553h-x28j

medium2026-05-11

CVE-2026-39960-MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values

mantisbt/mantisbt · GHSA-qj6w-v29q-4rgx

high2026-05-11

CVE-2026-39850-Yii 2: Local file inclusion via view parameter name collision

yiisoft/yii2 · GHSA-5vpg-rj7q-qpw2

medium2026-05-11

CVE-2026-34970-MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked

mantisbt/mantisbt · GHSA-crmx-4p49-46m2

medium2026-05-11

CVE-2026-34754-MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API

mantisbt/mantisbt · GHSA-h4x5-gvx6-3rwc

medium2026-05-11

CVE-2026-34744-MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue

mantisbt/mantisbt · GHSA-rmp5-5jj7-gmvf

medium2026-05-11

CVE-2026-34579-MantisBT has an authorization bypass in private issue monitoring

mantisbt/mantisbt · GHSA-ggw7-9675-6v4v

high2026-05-11

CVE-2026-34463-MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form

mantisbt/mantisbt · GHSA-fvjf-68wh-rwp2

medium2026-05-11

CVE-2026-34390-MantisBT Vulnerable to Privilege Escalation from Manager to Administrator

mantisbt/mantisbt · GHSA-frf7-jhp9-jxm6

high2026-05-11

CVE-2026-2393-MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability

mlflow/mlflow · GHSA-65h7-c7c4-mghx

high2026-05-11

CVE-2026-30635-automagik-genie has a command injection vulnerability

automagik-dev/genie · GHSA-64vr-4gr2-m642

medium2026-05-11

CVE-2026-6815-Casdoor: Arbitrary file write possible through Local File System storage provider

casdoor/casdoor · GHSA-rmxx-v9rj-vpvg

high2026-05-11

CVE-2026-7817-pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities

pgadmin-org/pgadmin4 · GHSA-p58c-q354-6c4f

high2026-05-11

CVE-2026-7816-pgAdmin 4: OS command injection vulnerability in Import/Export query export

pgadmin-org/pgadmin4 · GHSA-j74f-g7vx-fh4x

medium2026-05-11

CVE-2026-7820-pgAdmin 4: Improper restriction of excessive authentication attempts

pgadmin-org/pgadmin4 · GHSA-hv9p-2pqf-r5w3

high2026-05-11

CVE-2026-7819- pgAdmin 4 File Manager has symbolic-link path traversal

pgadmin-org/pgadmin4 · GHSA-hr4r-fwpv-c95j