Security advisories

high2026-05-08

CVE-2023-42346-Alkacon OpenCms is vulnerable to XXE when the <!DOCTYPE> refers to an external host

alkacon/opencms-core · GHSA-pj6p-9p8x-5mfc

medium2026-05-08

CVE-2023-42343-Alkacon OpenCms is vulnerable to XSS via cmis-online/type

alkacon/opencms-core · GHSA-8gpv-c454-3hfc

medium2026-05-08

CVE-2023-42345-Alkacon OpenCms is vulnerable to XSS via updateModelGroups.jsp

alkacon/opencms-core · GHSA-2887-f3v6-6rjf

medium2026-05-08

CVE-2026-8115-short-video-maker has a path traversal vulnerability

gyoridavid/short-video-maker · GHSA-935g-9rq5-q95c

medium2026-05-08

CVE-2026-40214-OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer

openstack/cyborg · GHSA-mmpc-xjxr-5hf8

high2026-05-08

CVE-2026-40213-OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints

openstack/cyborg · GHSA-mm7j-mhhj-hj36

medium2026-05-07

CVE-2026-44662-rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding

rust-openssl/rust-openssl · GHSA-xv59-967r-8726

medium2026-05-07

CVE-2026-44661-utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

universal-tool-calling-protocol/python-utcp · GHSA-39j6-4867-gg4w

high2026-05-07

netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables

alef-burzmali/netbox-data-flows · GHSA-v7qw-hx66-4w9x

high2026-05-07

mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening

oaslananka/mcp-ssh-tool · GHSA-j7h9-2jh7-g967

high2026-05-07

CVE-2026-44641-Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install

microsoft/apm · GHSA-xhrw-5qxx-jpwr

high2026-05-07

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

lin-snow/ech0 · GHSA-fpw6-hrg5-q5x5

high2026-05-07

Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft

lin-snow/ech0 · GHSA-p64j-f4x9-wq66

low2026-05-07

CVE-2026-8088-OSGeo GDAL vulnerable to out-of-bounds read

osgeo/gdal · GHSA-j3f5-rw74-g4rv

low2026-05-07

CVE-2026-8087-OSGeo GDAL vulnerable to heap-based buffer overflow

osgeo/gdal · GHSA-h9rh-5ffh-h669

high2026-05-07

Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfo

lin-snow/ech0 · GHSA-8mc6-xjpr-h98x

medium2026-05-07

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count

lin-snow/ech0 · GHSA-pj6q-4vq4-r8cg

medium2026-05-07

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

lin-snow/ech0 · GHSA-rgj7-vg8v-j4wr

medium2026-05-07

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

lin-snow/ech0 · GHSA-3v85-fqvh-7rxf

medium2026-05-07

Ech0 comment model's Email field returned on public /api/comments endpoints

lin-snow/ech0 · GHSA-rj4g-rqgh-rx9h