Security advisories

medium2026-05-07

CVE-2026-40610-BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context

bentoml/bentoml · GHSA-mcfx-4vc6-qgxv

medium2026-05-07

CVE-2025-67202-Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL

sidekiq-cron/sidekiq-cron · GHSA-xv9c-mjw8-79gf

high2026-05-07

CVE-2025-63705-node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js

nicolaspearson/node.ts.ocr · GHSA-8jh2-3mw6-6pfm

critical2026-05-07

CVE-2025-63706-next-npm-version is vulnerable to Command injection

afeiship/next-npm-version · GHSA-2xx6-qf7x-grqh

medium2026-05-07

CVE-2026-41004-Spring Cloud Config Server Logged Sensitive Information

spring-cloud/spring-cloud-config · GHSA-j6hh-h3cf-c2hf

high2026-05-07

CVE-2026-41002-Spring Cloud Config Server Susceptible To TOCTOU Attack

spring-cloud/spring-cloud-config · GHSA-86wq-234q-r6wg

critical2026-05-07

CVE-2026-40982-Spring Cloud Config vulnerable to Path Traversal

spring-cloud/spring-cloud-config · GHSA-6g23-24mc-hx6x

high2026-05-07

CVE-2026-40981-Spring Cloud Config has an Authorization Bypass Through User-Controlled Key

spring-cloud/spring-cloud-config · GHSA-2mh5-3cw6-hrrq

high2026-05-07

CVE-2026-44513-Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components

huggingface/diffusers · GHSA-98h9-4798-4q5v

medium2026-05-07

CVE-2026-44248-Netty MQTT: Resource exhaustion in MqttDecoder

netty/netty · GHSA-jfg9-48mv-9qgx

critical2026-05-07

CVE-2026-44007-vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution

patriksimek/vm2 · GHSA-8hg8-63c5-gwmx

high2026-05-07

CVE-2026-43998-vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape

patriksimek/vm2 · GHSA-cp6g-6699-wx9c

medium2026-05-07

CVE-2026-44003-vm2's Transformer Fast-Path Bypass Exposes Internal State Variable

patriksimek/vm2 · GHSA-wp5r-2gw5-m7q7

medium2026-05-07

CVE-2026-44002-vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak

patriksimek/vm2 · GHSA-v27g-jcqj-v8rw

medium2026-05-07

CVE-2026-44000-vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary

patriksimek/vm2 · GHSA-mpf8-4hx2-7cjg

high2026-05-07

CVE-2026-44004-vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion

patriksimek/vm2 · GHSA-6785-pvv7-mvg7

high2026-05-07

CVE-2026-44001-vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)

patriksimek/vm2 · GHSA-hw58-p9xv-2mjh

critical2026-05-07

CVE-2026-43999-vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape

patriksimek/vm2 · GHSA-947f-4v7f-x2v8

critical2026-05-07

CVE-2026-44005-vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape

patriksimek/vm2 · GHSA-vwrp-x96c-mhwq

critical2026-05-07

CVE-2026-43997-vm2 Access to Host Object Enables Sandbox Escape

patriksimek/vm2 · GHSA-47x8-96vw-5wg6