Security advisories

medium2026-05-06

kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection

cloudnativelabs/kube-router · GHSA-v5mh-h5hx-7v92

low2026-05-06

rpassword affected by partial password reveal when input is interrupted

conradkleinespel/rpassword · GHSA-2p6r-x3vv-xqm2

medium2026-05-06

CVE-2026-44223-vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters

vllm-project/vllm · GHSA-83vm-p52w-f9pw

high2026-05-06

CVE-2026-44307-Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

sqlalchemy/mako · GHSA-2h4p-vjrc-8xpq

high2026-05-06

CVE-2026-42557-JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content

jupyterlab/jupyterlab · GHSA-mqcg-5x36-vfcg

critical2026-05-06

CVE-2026-42555-Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users

valtimo-platform/valtimo · GHSA-j7j9-5253-f7vh

high2026-05-06

CVE-2026-42552-Flight vulnerable to sensitive information disclosure via default error handler

flightphp/core · GHSA-qrch-52m5-vv85

high2026-05-06

CVE-2026-42551-Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass

flightphp/core · GHSA-vxrr-w42w-w76g

high2026-05-06

CVE-2026-42550-Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete

flightphp/core · GHSA-xwqr-rcqg-22mr

medium2026-05-06

CVE-2026-42549-Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root

flightphp/core · GHSA-3xjv-pmf2-gf2q

high2026-05-06

CVE-2026-42548-Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()

flightphp/core · GHSA-fcx8-ph5r-mxr4

medium2026-05-06

CVE-2026-42545-Granian vulnerable to DoS via WSGI response header panic

emmett-framework/granian · GHSA-f5p7-9fr5-8jmj

high2026-05-06

CVE-2026-42544-Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic

emmett-framework/granian · GHSA-vrg7-482j-p6f6

high2026-05-06

CVE-2026-42844-Low-privileged Grav API users can create super-admin accounts via blueprint-upload

getgrav/grav · GHSA-6xx2-m8wv-756h

medium2026-05-06

CVE-2026-44301-Hugo's Node tool execution allows file system access outside the project directory

gohugoio/hugo · GHSA-x597-9fr4-5857

medium2026-05-06

CVE-2026-42458-Magento LTS: Reflected XSS - Import -> Data Flow (profiles)

openmage/magento-lts · GHSA-x8jv-q8j2-487c

medium2026-05-06

CVE-2026-44306-Statamic CMS vulnerable to email enumeration via forgot password endpoint

statamic/cms · GHSA-m24v-f7g5-gq67

high2026-05-06

CVE-2026-44302-Snappier has an infinite loop during SnappyStream decompression with malformed framed input

brantburnett/snappier · GHSA-pggp-6c3x-2xmx

critical2026-05-06

CVE-2026-46364-phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha

thorsten/phpmyfaq · GHSA-289f-fq7w-6q2w

medium2026-05-06

CVE-2026-45008-phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins

thorsten/phpmyfaq · GHSA-gh9p-q46p-57g2