Security advisories

high2026-05-11

CVE-2026-44432-urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

urllib3/urllib3 · GHSA-mf9v-mfxr-j63j

high2026-05-11

CVE-2026-44431-urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

urllib3/urllib3 · GHSA-qccp-gfcp-xxvc

high2026-05-11

@vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components

vitejs/vite-plugin-react · GHSA-w94c-4vhp-22gx

high2026-05-11

Next.js Vulnerable to Denial of Service with Server Components

vercel/next.js · GHSA-8h8q-6873-q5fj

high2026-05-11

CVE-2026-23870-Facebook React has a Denial of Service Vulnerability in React Server Components

facebook/react · GHSA-rv78-f8rc-xrxh

high2026-05-11

CVE-2026-45022-go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

go-git/go-git · GHSA-389r-gv7p-r3rp

high2026-05-11

CVE-2026-44971-GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration

datadog/guarddog · GHSA-587r-mc96-6f2p

medium2026-05-11

CVE-2026-44972-GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content

datadog/guarddog · GHSA-m5p4-gvpx-4mvr

medium2026-05-11

CVE-2026-6420-Keylime has a hardcoded attestation challenge nonce that allows replay attacks

keylime/keylime · GHSA-q8w6-w55c-ccv5

high2026-05-11

CVE-2026-44902-Prometheus exporter process crash via malformed HTTP request

open-telemetry/opentelemetry-js · GHSA-q7rr-3cgh-j5r3

medium2026-05-11

Steamworks game clients/servers using P2P authentication vulnerable to denial of service

noxime/steamworks-rs · GHSA-g588-cjg3-6g78

medium2026-05-11

CVE-2026-44353-Streamlink has an arbitrary local file read via file:// URI in HLS and DASH

streamlink/streamlink · GHSA-hgqw-6m45-hw5f

high2026-05-11

CVE-2026-44346-Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)

bentoml/bentoml · GHSA-w2pm-x38x-jp44

high2026-05-11

CVE-2026-44345-BentoML Dockerfile command injection via docker.base_image (sister of pending GHSA-w2pm-x38x-jp44 / CVE-2026-33744 / CVE-2026-35043)

bentoml/bentoml · GHSA-78f9-r8mh-4xm2

high2026-05-11

CVE-2026-44570-Open WebUI has inconsistent authorization controls within memories API

open-webui/open-webui · GHSA-hmjq-crxp-7rjw

high2026-05-11

CVE-2026-44985-Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authentication

amir20/dozzle · GHSA-j643-x8pv-8m67

medium2026-05-11

CVE-2026-44571-Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission

open-webui/open-webui · GHSA-jgj3-r8hr-9pjw

high2026-05-11

CVE-2026-44569-Open WebUI's Insecure Message Access Breaks Authorization

open-webui/open-webui · GHSA-jxwr-g6r6-j3fx

high2026-05-11

CVE-2026-44565-Open WebUI Arbitrary File Write, Delete via Path Traversal

open-webui/open-webui · GHSA-j3fw-wc48-29g3

high2026-05-11

Open WebUI has a CORS misconfiguration and session validation issue

open-webui/open-webui · GHSA-6xcp-7mpr-m7wm