Security advisories

critical2026-05-07

CVE-2026-44523-Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery

enchant97/note-mark · GHSA-q6mh-rqwh-g786

high2026-05-07

CVE-2026-44522-Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution

enchant97/note-mark · GHSA-g49p-4qxj-88v3

low2026-05-07

Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy

web-auth/webauthn-framework · GHSA-h4fw-6r7f-w494

critical2026-05-07

Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs

zcashfoundation/zebra · GHSA-cwfq-rfcr-8hmp

critical2026-05-07

CVE-2026-44497-Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer

zcashfoundation/zebra · GHSA-gq4h-3grw-2rhv

medium2026-05-07

CVE-2026-44500-Zebra Vulnerable to Allocation Amplification in Inbound Network Deserializers

zcashfoundation/zebra · GHSA-438q-jx8f-cccv

critical2026-05-07

CVE-2026-44498-Zebra's Block Validator Undercounts Coinbase and P2SH Sigops

zcashfoundation/zebra · GHSA-jv4h-j224-23cc

low2026-05-07

CVE-2026-44589-nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)

nuxt-modules/og-image · GHSA-c2rm-g55x-8hr5

medium2026-05-07

CVE-2026-42879-FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

neorazorx/facturascripts · GHSA-vf3q-frmr-vrr9

medium2026-05-07

CVE-2026-42878-FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint

neorazorx/facturascripts · GHSA-vrxf-vrc4-22p7

medium2026-05-07

CVE-2026-42877-FacturaScripts vulnerable to stored XSS via product reference in sales/purchases

neorazorx/facturascripts · GHSA-r736-2678-fcrx

low2026-05-07

CVE-2026-27964-FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation

neorazorx/facturascripts · GHSA-gq5c-rw37-g46c

medium2026-05-07

CVE-2026-27892-FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

neorazorx/facturascripts · GHSA-q7f2-rv22-2xgr

high2026-05-07

CVE-2026-27891-FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism

neorazorx/facturascripts · GHSA-3pgc-xqg9-cfr6

medium2026-05-07

CVE-2026-36341-Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint

krayin/laravel-crm · GHSA-j822-46r5-h4qx

critical2026-05-07

CVE-2025-63704-query-parser-string is vulnerable to Prototype Pollution

victorteokw/query-string-parser · GHSA-587p-w43q-4hjx

high2026-05-07

CVE-2025-65122-youtube-regex vulnerable to Regex Denial of Service

regexhq/youtube-regex · GHSA-vpxx-h23g-gxh2

critical2026-05-07

Compromised version of intercom-client published to npm

intercom/intercom-node · GHSA-54pg-9963-v8vg

critical2026-05-07

Compromised tag of intercom-php published via GitHub

intercom/intercom-php · GHSA-gr3r-crp5-qrrm

high2026-05-07

CVE-2026-42553-Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker

cinnyapp/cinny · GHSA-j944-w549-3453