Security advisories

high2026-05-06

CVE-2026-46366-phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query

thorsten/phpmyfaq · GHSA-99qv-g4x9-mgc3

high2026-05-06

CVE-2026-46359-phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields

thorsten/phpmyfaq · GHSA-pm8c-3qq3-72w7

critical2026-05-06

CVE-2026-45010-phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

thorsten/phpmyfaq · GHSA-9pq7-mfwh-xx2j

low2026-05-06

CVE-2026-42448-Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed

magic-wormhole/magic-wormhole · GHSA-cf92-gfcw-6v53

medium2026-05-06

CVE-2026-45009-phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ

thorsten/phpmyfaq · GHSA-jrc5-w569-h7h5

medium2026-05-06

CVE-2026-46361-phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering

thorsten/phpmyfaq · GHSA-pqh6-8fxf-jx22

medium2026-05-06

CVE-2026-45007-phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User

thorsten/phpmyfaq · GHSA-rm98-82fr-mcfx

medium2026-05-06

CVE-2026-46360-phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

thorsten/phpmyfaq · GHSA-whqh-9pq5-c7r3

medium2026-05-06

CVE-2026-46363-phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization

thorsten/phpmyfaq · GHSA-f5p7-2c9q-8896

high2026-05-06

CVE-2025-71261-Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS

harvester/harvester · GHSA-pgh9-mpwc-8jjf

medium2026-05-06

phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags

thorsten/phpmyfaq · GHSA-7cx3-2qx2-3g6w

medium2026-05-06

CVE-2026-46362-phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check

thorsten/phpmyfaq · GHSA-hpgw-ww76-c68r

high2026-05-06

CVE-2026-46367-phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering

thorsten/phpmyfaq · GHSA-9525-27vj-c8r8

high2026-05-06

CVE-2026-44241-Micronaut has unbounded `formattersCache` in `TimeConverterRegistrar` that Allows Memory Exhaustion via `Accept-Language` Header

micronaut-projects/micronaut-core · GHSA-8hjv-92q9-g4xj

low2026-05-06

CVE-2026-44242-Micronaut has Unbounded `bundleCache` in `ResourceBundleMessageSource` that Allows Memory Exhaustion via `Accept-Language` Header

micronaut-projects/micronaut-core · GHSA-3rfq-4wpf-qqw3

high2026-05-06

Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drain

mezo-org/mezod · GHSA-6447-269v-g68m

critical2026-05-06

CVE-2026-44262-Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules

dedoc/scramble · GHSA-4rm2-28vj-fj39

medium2026-05-06

wger: trainer_login open redirect - ?next= parameter not validated against host

wger-project/wger · GHSA-vqv8-j3mj-wjxj

critical2026-05-06

CVE-2026-43948-wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

wger-project/wger · GHSA-mhc8-p3jx-84mm

high2026-05-06

wger: CSV/TSV formula injection in gym member export (first_name/last_name)

wger-project/wger · GHSA-xq9m-hmp9-fw87