Security advisories

high2026-05-07

CVE-2026-42582-Netty HTTP/3 QPACK literal unbounded allocation

netty/netty · GHSA-2c5c-chwr-9hqw

medium2026-05-07

CVE-2026-42581-Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

netty/netty · GHSA-xxqh-mfjm-7mv9

medium2026-05-07

CVE-2026-42580-Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing

netty/netty · GHSA-m4cv-j2px-7723

high2026-05-07

CVE-2026-42579-Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)

netty/netty · GHSA-cm33-6792-r9fm

low2026-05-07

CVE-2026-42578-Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)

netty/netty · GHSA-45q3-82m4-75jr

low2026-05-07

OpenSearch has ineffective TLS certificate hostname verification

opensearch-project/security · GHSA-x5hg-x4gv-j98m

medium2026-05-07

CVE-2026-44216-wasmtime has a panic when allocating a table exceeding the size of the host's address space

bytecodealliance/wasmtime · GHSA-p8xm-42r7-89xg

medium2026-05-07

OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation

opensearch-project/security · GHSA-x83w-23jp-g6pw

low2026-05-07

OpenSearch vulnerable to improper authorization for Rollover Requests

opensearch-project/security · GHSA-22vx-2x23-98w6

low2026-05-07

OpenSearch has a bypass of REST Layer Authorization Using Malformed Paths

opensearch-project/security · GHSA-83x9-vc3c-hghc

medium2026-05-07

CVE-2026-44308-Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications

awspring/spring-cloud-aws · GHSA-r4w4-wv68-qv85

medium2026-05-07

CVE-2026-44479-Vercel: Non-interactive mode includes CLI arguments in suggested command output

vercel/vercel · GHSA-pgf8-2hgj-grqg

medium2026-05-07

CVE-2026-44264-Weblate vulnerable to XSS via crafted Markdown

weblateorg/weblate · GHSA-5cmv-3rc4-7279

medium2026-05-07

CVE-2026-44263-Weblate Vulnerable to Private Translation Enumeration via Screenshot API

weblateorg/weblate · GHSA-gcg5-86jr-f7jg

low2026-05-07

diesel-async may expose uninitialized padding bytes for MySQL temporal columns

diesel-rs/diesel_async · GHSA-ff9q-rm55-q7qr

high2026-05-07

CVE-2026-44471-gix-fs: Symlink prefix-reuse allows worktree escape during checkout

gitoxidelabs/gitoxide · GHSA-f89h-2fjh-2r9q

medium2026-05-06

CVE-2026-44456-Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

honojs/hono · GHSA-9vqf-7f2p-gf9v

medium2026-05-06

CVE-2026-44455-hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

honojs/hono · GHSA-69xw-7hcm-h432

medium2026-05-06

Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users

lemmynet/lemmy · GHSA-qxrw-f6fh-34r7

medium2026-05-06

CVE-2026-44439-Playwright Capture permits access to local files and internal network resources during page capture

lookyloo/playwrightcapture · GHSA-687h-xw6f-q2qw