Security advisories

high2026-05-08

CVE-2026-44671-ZITADEL has LDAP Filter Injection in Login Flow

zitadel/zitadel · GHSA-rxvx-hhpj-q6px

high2026-05-08

CVE-2026-44700-ex_webrtc client-role handshake is missing DTLS peer fingerprint validation

elixir-webrtc/ex_webrtc · GHSA-qwfw-ggxw-577c

low2026-05-08

CVE-2026-44428-MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience

modelcontextprotocol/registry · GHSA-95c3-6vvw-4mrq

medium2026-05-08

CVE-2026-44427-MCP Registry has open redirect via protocol-relative path in trailing-slash middleware

modelcontextprotocol/registry · GHSA-v8vw-gw5j-w7m6

high2026-05-08

n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure

czlonkowski/n8n-mcp · GHSA-8g7g-hmwm-6rv2

high2026-05-08

CVE-2026-44694-n8n-mcp webhook and API client paths has an authenticated SSRF

czlonkowski/n8n-mcp · GHSA-cmrh-wvq6-wm9r

critical2026-05-08

CVE-2026-44212-PrestaShop has a stored XSS executable in customer service view

prestashop/prestashop · GHSA-w9f3-qc75-qgx9

critical2026-05-08

CVE-2026-44670-SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE

siyuan-note/siyuan · GHSA-2h64-c999-c9r6

high2026-05-08

gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense

arthurkatcher/google-maps-mcp · GHSA-52cq-7v8r-62c6

high2026-05-08

CVE-2026-44665-fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes

naturalintelligence/fast-xml-builder · GHSA-5wm8-gmm8-39j9

medium2026-05-08

CVE-2026-44664-fast-xml-builder Comment Value regex can be bypassed

naturalintelligence/fast-xml-builder · GHSA-45c6-75p6-83cc

medium2026-05-08

vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`

patriksimek/vm2 · GHSA-2cm2-m3w5-gp2f

critical2026-05-08

CVE-2026-44009-vm2 has Sandbox Breakout Through Null Proto Exception

patriksimek/vm2 · GHSA-9vg3-4rfj-wgcm

critical2026-05-08

CVE-2026-44008-vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`

patriksimek/vm2 · GHSA-9qj6-qjgg-37qq

medium2026-05-08

CVE-2026-40295-Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler

heartcombo/devise · GHSA-jp94-3292-c3xv

high2026-05-08

CVE-2026-39816-Apache NiFi is missing the Restricted annotation with the Execute Code Required Permission

apache/nifi · GHSA-2j9m-25xv-mp6r

high2026-05-08

CVE-2023-42344-Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information

alkacon/opencms-core · GHSA-rcc6-6q2f-m2cw

high2026-05-08

CVE-2023-42346-Alkacon OpenCms is vulnerable to XXE when the <!DOCTYPE> refers to an external host

alkacon/opencms-core · GHSA-pj6p-9p8x-5mfc

medium2026-05-08

CVE-2023-42343-Alkacon OpenCms is vulnerable to XSS via cmis-online/type

alkacon/opencms-core · GHSA-8gpv-c454-3hfc

medium2026-05-08

CVE-2023-42345-Alkacon OpenCms is vulnerable to XSS via updateModelGroups.jsp

alkacon/opencms-core · GHSA-2887-f3v6-6rjf