Security advisories

medium2026-05-08

CVE-2026-44324-free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)

free5gc/free5gc · GHSA-jqfc-gwj5-3w63

medium2026-05-08

CVE-2026-44323-free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)

free5gc/free5gc · GHSA-4rqf-grm6-vf75

high2026-05-08

CVE-2026-44322-free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference

free5gc/free5gc · GHSA-j59f-x285-69jx

high2026-05-08

CVE-2026-44321-free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)

free5gc/free5gc · GHSA-44qj-cghf-9p97

high2026-05-08

CVE-2026-44320-free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path

free5gc/free5gc · GHSA-wqfh-gq79-j8mf

high2026-05-08

CVE-2026-44319-free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)

free5gc/free5gc · GHSA-rxrq-fv76-26pr

medium2026-05-08

CVE-2026-44318-free5GC's BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions

free5gc/free5gc · GHSA-27ph-8q4f-h7m7

medium2026-05-08

CVE-2026-44317-free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference

free5gc/free5gc · GHSA-wwqh-7jm5-gj7w

high2026-05-08

CVE-2026-44316-free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference

free5gc/free5gc · GHSA-wr8j-6chw-gm6p

critical2026-05-08

CVE-2026-44315-free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

free5gc/free5gc · GHSA-5f62-53r8-qrqf

medium2026-05-08

CVE-2026-44309-gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits

sigstore/gitsign · GHSA-7rmh-48mx-2vwc

high2026-05-08

CVE-2026-44566-Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal

open-webui/open-webui · GHSA-9pgh-j74g-qj6m

high2026-05-08

CVE-2026-44567-Open WebUI has Improper Authorization Control

open-webui/open-webui · GHSA-4vg5-rp28-gvjf

high2026-05-08

CVE-2026-44549-Open WebUI has stored XSS in Excel file preview

open-webui/open-webui · GHSA-jwf8-pv5p-vhmc

high2026-05-08

CVE-2026-44832-Snipe-IT has Privilege Escalation via API Permissions Assignment

grokability/snipe-it · GHSA-hq28-crg7-95pr

medium2026-05-08

in-toto-golang and in-toto-python have inconsistent negation behavior

in-toto/in-toto-golang · GHSA-pmwq-pjrm-6p5r

medium2026-05-08

CVE-2026-44831-Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)

grokability/snipe-it · GHSA-r42m-953q-6vjx

medium2026-05-08

CVE-2026-44298-Kimai has an arbitrary file read in its invoice PDF renderer (admin)

kimai/kimai · GHSA-h5fh-7hwr-97mw

medium2026-05-08

CVE-2026-44568-Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order

open-webui/open-webui · GHSA-fq3v-xjjx-95rc

medium2026-05-08

CVE-2026-44214-eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields

rexxars/eventsource-encoder · GHSA-m9g3-3g99-mhpx