Security Advisories

low2026-10-07

CVE-2026-105682-Ghost: Server-Side Request Forgery in Webhook Trigger

View chart

tryghost/ghost · GHSA-354h-gmhv-mr9c

low2026-10-07

CVE-2026-105683-Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

View chart

tryghost/ghost · GHSA-83rp-q473-j88c

medium2026-10-07

CVE-2026-106452-yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

View chart

yawkat/lz4-java · GHSA-4v53-57pg-c464

medium2026-10-07

CVE-2026-106453-yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

View chart

yawkat/lz4-java · GHSA-6cx8-rjf8-pr8g

critical2026-10-07

CVE-2026-73487-Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

View chart

flowiseai/flowise · GHSA-w7x8-q2gp-5cgg

critical2026-10-07

CVE-2026-73483-Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

View chart

flowiseai/flowise · GHSA-9gvv-qjj3-2p6g

high2026-10-07

CVE-2026-106105-Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

View chart

quasarframework/quasar · GHSA-fh39-c73x-5pjv

high2026-10-07

CVE-2026-106106-Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

View chart

quasarframework/quasar · GHSA-r5mf-4r5x-q78f

high2026-10-07

CVE-2026-106107-Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

View chart

quasarframework/quasar · GHSA-5m6h-8g35-p3m7

medium2026-10-07

CVE-2026-106108-Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

View chart

quasarframework/quasar · GHSA-vhhq-m2gm-rwc9

medium2026-10-07

CVE-2026-106109-Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

View chart

quasarframework/quasar · GHSA-q9mq-245r-4g93

high2026-10-07

CVE-2026-106104-Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

View chart

quasarframework/quasar · GHSA-68jq-fhch-4xq4

critical2026-10-07

CVE-2026-106102-Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

View chart

quasarframework/quasar · GHSA-pq96-jpmf-w254

high2026-10-07

CVE-2026-106103-Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

View chart

quasarframework/quasar · GHSA-wmpw-j6qv-mw88

high2026-10-07

CVE-2026-62251-Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

View chart

sipcapture/homer · GHSA-f46q-3v67-fmm4

critical2026-10-07

CVE-2026-62252-Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

View chart

sipcapture/homer · GHSA-6xp5-7rcx-xfgx

critical2026-10-07

CVE-2026-62253-Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

View chart

sipcapture/homer · GHSA-rqcc-94gv-wjm9

critical2026-10-07

CVE-2026-62176-PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

View chart

mervinpraison/praisonai · GHSA-g6j7-pffp-8whg

medium2026-10-07

CVE-2026-62179-PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

View chart

mervinpraison/praisonai · GHSA-mxmx-rh57-jx58

high2026-10-07

CVE-2026-61436-PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

View chart

mervinpraison/praisonai · GHSA-7c92-x8vg-4258