Security advisories

high2026-05-08

CVE-2026-44721-open-webui Vulnerable to Stored XSS via Model Description

open-webui/open-webui · GHSA-gf5m-wcrh-7928

critical2026-05-08

CVE-2026-43944-Electerm users can run dangrous code through link or command line

electerm/electerm · GHSA-mpm8-cx2p-626q

high2026-05-08

CVE-2026-43943-Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor

electerm/electerm · GHSA-q4p8-8j9m-8hxj

medium2026-05-08

CVE-2026-43942-Electerm's full process.env exposed to renderer via window.pre.env

electerm/electerm · GHSA-37j4-88rp-2f6h

high2026-05-08

CVE-2026-43941-Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click

electerm/electerm · GHSA-fwf6-j56g-m97c

critical2026-05-08

CVE-2026-43940-Electerm runWidget has a path traversal that leads to arbitrary code execution

electerm/electerm · GHSA-f77v-9vpc-6pjm

low2026-05-08

CVE-2026-42794-absinthe_plug Has a Cross-site Scripting vulnerability

absinthe-graphql/absinthe_plug · GHSA-c62g-j346-39v5

critical2026-05-08

CVE-2026-38360-dash-uploader has a directory traversal vulnerability

fohrloop/dash-uploader · GHSA-3rf6-x59v-5jfv

critical2026-05-08

Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output

zcashfoundation/zebra · GHSA-pvmv-cwg8-v6c8

high2026-05-08

CVE-2024-27355-phpseclib guardrails needed on OID length

phpseclib/phpseclib · GHSA-f2qx-66wf-wvvx

low2026-05-08

justhtml introduces denial-of-service hardening

emilstenstrom/justhtml · GHSA-r8cj-3554-33mr

high2026-05-08

CVE-2026-44714-bitcoinj has a ScriptExecution P2PKH/P2WPKH Verification Bypass

bitcoinj/bitcoinj · GHSA-hfcf-v2f8-x9pc

low2026-05-08

nhost has Session Persistence After Password Change

nhost/nhost · GHSA-7hgr-xvrr-xpw3

medium2026-05-08

CVE-2026-44310-gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers

sigstore/gitsign · GHSA-7c37-gx6w-8vc5

medium2026-05-08

`potato-annotation` has a Project-Boundary Bypass

davidjurgens/potato · GHSA-q9m2-fhv9-3jcf

medium2026-05-08

CVE-2026-42876-ExternalSecrets vulnerable to privilege escalation with secret overwriting

external-secrets/external-secrets · GHSA-fq7h-9x26-6j22

medium2026-05-08

CVE-2026-44430-MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist

modelcontextprotocol/registry · GHSA-r48c-v28r-pf6v

medium2026-05-08

CVE-2026-44429-MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`

modelcontextprotocol/registry · GHSA-rqv2-m695-f8j4

high2026-05-08

CVE-2026-6321-fast-uri vulnerable to path traversal via percent-encoded dot segments

fastify/fast-uri · GHSA-q3j6-qgpj-74h6

high2026-05-08

CVE-2026-7768-@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

fastify/fastify-accepts-serializer · GHSA-qxhc-wx3p-2wmg