Security advisories

high2026-05-06

CVE-2026-42845-Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override

getgrav/grav · GHSA-w4rc-p66m-x6qq

medium2026-05-06

CVE-2026-44372-Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

nitrojs/nitro · GHSA-9phm-9p8f-hw5m

medium2026-05-06

CVE-2026-44373-Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`

nitrojs/nitro · GHSA-5w89-w975-hf9q

medium2026-05-06

CVE-2026-44368-pyquorum: Timing side‑channel in mul_mod

svvqt/pyquorum · GHSA-7r92-3jgr-r65q

low2026-05-06

MediaMTX affected by CVE-2026-27143 due to vulnerable dependency

bluenviron/mediamtx · GHSA-2ccx-cjjh-r2j8

high2026-05-06

CVE-2026-42602-opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay

open-telemetry/opentelemetry-collector-contrib · GHSA-pjv4-3c63-699f

critical2026-05-06

CVE-2026-44364-misp-modules website - Missing CSRF protection in the website home blueprint

misp/misp-modules · GHSA-j4rh-7jcr-qm69

medium2026-05-06

CVE-2026-44363-misp-modules has nsafe remote resource fetching in expansion

misp/misp-modules · GHSA-fhq3-2gf3-8f3j

critical2026-05-06

CVE-2026-44351-fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver

nearform/fast-jwt · GHSA-gmvf-9v4p-v8jc

medium2026-05-06

Lemmy may expose private community data through community, saved, liked, and modlog API views

lemmynet/lemmy · GHSA-95q8-x6r6-672m

medium2026-05-06

Private Lemmy instances expose multi-community metadata without authentication

lemmynet/lemmy · GHSA-jmxc-hhwx-gvv3

medium2026-05-06

CVE-2026-44245-Kyverno policy-reporter-ui has XSS via Stored Property Values in PropertyCard Component

kyverno/kyverno · GHSA-q98m-7w8c-w388

high2026-05-06

CVE-2026-44349-Daptin fuzzy search injects unvalidated column name into raw SQL

daptin/daptin · GHSA-pwqg-q8pg-pp6r

high2026-05-06

CVE-2026-44334-PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)

mervinpraison/praisonai · GHSA-xcmw-grxf-wjhj

high2026-05-06

CVE-2026-44335-PraisonAI has an SSRF bypass

mervinpraison/praisonai · GHSA-q9pw-vmhh-384g

low2026-05-06

aiograpi has dependency on vulnerable orjson 3.11.4 (CVE-2025-67221)

subzeroid/aiograpi · GHSA-7mw3-79jq-xc7f

medium2026-05-06

CVE-2026-42572-Hatchet affected by cross-tenant information disclosure in `listTasksByDAGIds`

hatchet-dev/hatchet · GHSA-55gc-6fmc-fpx9

high2026-05-06

CVE-2026-44244-GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

gitpython-developers/gitpython · GHSA-v87r-6q3f-2j67

high2026-05-06

CVE-2026-42561-python-multipart has Denial of Service via unbounded multipart part headers

kludex/python-multipart · GHSA-pp6c-gr5w-3c5g

high2026-05-06

CVE-2026-42559-rmcp Streamable HTTP server transport has a DNS rebinding vulnerability

modelcontextprotocol/rust-sdk · GHSA-89vp-x53w-74fx