Security advisories

high2026-05-11

CVE-2026-44521-elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)

studio-42/elfinder · GHSA-c3gj-q88f-7hqj

high2026-05-11

CVE-2026-44516-Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer

valtimo-platform/valtimo · GHSA-3jh5-rr2q-xfv7

high2026-05-11

@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function

theecryptochad/merge-guard · GHSA-mhwj-73qx-jqxm

high2026-05-11

CVE-2026-44483-@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data)

airjp73/rvf · GHSA-c567-44rc-m5hq

critical2026-05-11

CVE-2026-44477-CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

cloudnative-pg/cloudnative-pg · GHSA-423p-g724-fr39

medium2026-05-11

CVE-2026-44581-Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces

vercel/next.js · GHSA-ffhc-5mcf-pf4q

low2026-05-11

CVE-2026-44582-Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

vercel/next.js · GHSA-vfv6-92ff-j949

medium2026-05-11

CVE-2026-44580-Next.js has cross-site scripting in beforeInteractive scripts with untrusted input

vercel/next.js · GHSA-gx5p-jg67-6x7h

high2026-05-11

CVE-2026-44579-Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components

vercel/next.js · GHSA-mg66-mrh9-m8jx

medium2026-05-11

CVE-2026-44577-Next.js has a Denial of Service in the Image Optimization API

vercel/next.js · GHSA-h64f-5h5j-jqjh

high2026-05-11

CVE-2026-44578-Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

vercel/next.js · GHSA-c4j6-fc7j-m34r

medium2026-05-11

CVE-2026-44576-Next.js vulnerable to cache poisoning in React Server Component responses

vercel/next.js · GHSA-wfc6-r584-vfw7

high2026-05-11

CVE-2026-44575-Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

vercel/next.js · GHSA-267c-6grr-h53f

high2026-05-11

CVE-2026-44574-Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

vercel/next.js · GHSA-492v-c6pp-mqqv

high2026-05-11

CVE-2026-44573-Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

vercel/next.js · GHSA-36qx-fr4f-26g5

low2026-05-11

CVE-2026-44474-Ella Core has handover failures during concurrent Security Mode Command

ellanetworks/core · GHSA-mc29-hmx6-856q

medium2026-05-11

CVE-2026-44475-Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest

ellanetworks/core · GHSA-pwfh-mqp3-pqwj

high2026-05-11

CVE-2026-44473-Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse

ellanetworks/core · GHSA-qfxw-v8qx-vj3v

high2026-05-11

CVE-2026-45017-python-liquid: Absolute paths escape filesystem loader search path

jg-rp/liquid · GHSA-8p4x-wr7x-3788

medium2026-05-11

oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)

bzsanti/oxidizepdf · GHSA-88q9-cmp2-c2vq