Security advisories

high2026-05-11

CVE-2026-7815-SQL injection vulnerability in pgAdmin 4 Maintenance Tool

pgadmin-org/pgadmin4 · GHSA-hp84-p2gq-6fvr

critical2026-05-11

CVE-2026-7813-pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules

pgadmin-org/pgadmin4 · GHSA-h2x2-q2mc-24gw

high2026-05-11

CVE-2026-31248-Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks

docling-project/docling · GHSA-9f4q-q82q-4359

high2026-05-11

CVE-2026-31253-flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism

dao-ailab/flash-attention · GHSA-7g5w-pq96-8c5w

medium2026-05-11

CVE-2026-7814-pgAdmin 4: Stored cross-site scripting (XSS) vulnerability in Browser Tree and Explain Visualizer modules

pgadmin-org/pgadmin4 · GHSA-6p2c-69cv-3fxq

high2026-05-11

CVE-2026-7818-pgAdmin 4 has deserialization of untrusted data in its FileBackedSessionManager

pgadmin-org/pgadmin4 · GHSA-4rhg-h8f2-v4jm

medium2026-05-11

CVE-2026-31246-GPT-Pilot contains a command injection vulnerability in the Executor.run() method

pythagora-io/gpt-pilot · GHSA-m85w-whwh-qvfx

high2026-05-11

CVE-2026-31247-Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks

docling-project/docling · GHSA-cr42-rg2m-mq4q

medium2026-05-11

CVE-2026-33052-MantisBT Has Authorization Bypass in Global Profile Creation

mantisbt/mantisbt · GHSA-68w5-w573-q2r8

critical2026-05-11

CVE-2026-27478-Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation

unitycatalog/unitycatalog · GHSA-qqcj-rghw-829x

critical2026-05-11

CVE-2026-25244-WebdriverIO BrowserStack Service has a Command Injection issue

webdriverio/webdriverio · GHSA-5c46-x3qw-q7j7

critical2026-05-11

torrentpier has PHP Serialize Injections

torrentpier/torrentpier · GHSA-h29g-c9cx-c73q

high2026-05-11

CVE-2026-45109-Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

vercel/next.js · GHSA-26hh-7cqf-hhc6

critical2026-05-11

CVE-2026-44643-Angular Expressions - Remote Code Execution using filters

peerigon/angular-expressions · GHSA-pw8r-6689-xvf4

high2026-05-11

CVE-2026-45061-Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)

budibase/budibase · GHSA-xh5j-727m-w6gg

high2026-05-11

CVE-2026-45047-Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding

xddxdd/bird-lg-go · GHSA-39qr-rc93-vhqm

high2026-05-11

CVE-2026-40217-LiteLLM has a sandbox escape in custom-code guardrail

berriai/litellm · GHSA-wxxx-gvqv-xp7p

high2026-05-11

CVE-2026-45033-GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

github/copilot-cli · GHSA-9ccr-r5hg-74gf

high2026-05-11

CVE-2026-44543-Local Path Provisioner Vulnerable to HelperPod Template Injection

rancher/local-path-provisioner · GHSA-7fxv-8wr2-mfc4

low2026-05-11

CVE-2026-44572-Next.js's Middleware / Proxy redirects can be cache-poisoned

vercel/next.js · GHSA-3g8h-86w9-wvmq