Security advisories

high2026-05-06

CVE-2026-44243-GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

gitpython-developers/gitpython · GHSA-7545-fcxq-7j24

high2026-05-06

CVE-2026-44240-basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering

patrickjuchli/basic-ftp · GHSA-rpmf-866q-6p89

high2026-05-06

CVE-2026-44304-Lemur: LDAP Filter Injection enables post-authentication privilege escalation

netflix/lemur · GHSA-3r34-vq8m-39gh

medium2026-05-06

CVE-2026-44305-Lemur: LDAP Authentication Globally Disables TLS Certificate Verification When LDAP_USE_TLS Is Enabled

netflix/lemur · GHSA-vr7c-r5gj-j3w5

medium2026-05-06

Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates

kimai/kimai · GHSA-vrqv-52x7-rm4v

medium2026-05-06

CVE-2026-6863-Velocidex Velociraptor has an Incorrect Authorization issue

velocidex/velociraptor · GHSA-2v93-vp82-cjv8

medium2026-05-06

Kimai has Missing Voter Check that Allows Cross-Team Timesheet Manipulation

kimai/kimai · GHSA-9g2q-w3w2-vf7q

medium2026-05-06

CVE-2026-79771-Nokogiri XSLT transform has a memory leak

sparklemotion/nokogiri · GHSA-v2fc-qm4h-8hqv

high2026-05-06

CVE-2026-79770-Nokogiri CSS selector tokenizer has regular expression backtracking

sparklemotion/nokogiri · GHSA-c4rq-3m3g-8wgx

high2026-05-06

CVE-2026-44232-dssrf: every IPv6 category bypasses is_url_safe

hackingrepo/dssrf-js · GHSA-8p33-q827-ghj5

high2026-05-06

CVE-2024-27354-phpseclib: guardrails needed on isPrime and randomPrime

phpseclib/phpseclib · GHSA-2528-jw5q-ww88

high2026-05-06

CVE-2026-44012-Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure

craftcms/cms · GHSA-33m5-hqp9-97pw

medium2026-05-06

CVE-2026-44226-PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI

pyload/pyload · GHSA-c3gc-9pf2-84gg

high2026-05-06

CVE-2026-44011-Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior

craftcms/cms · GHSA-qrgm-p9w5-rrfw

high2026-05-06

CVE-2026-44010-Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

craftcms/cms · GHSA-gj2p-p9m4-c8gw

medium2026-05-06

next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys

amannn/next-intl · GHSA-4c35-wcg5-mm9h

low2026-05-06

mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`

amannn/next-intl · GHSA-r27j-894h-3w3p

low2026-05-06

astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks

astral-sh/tokio-tar · GHSA-xx64-wwv2-hcqq

medium2026-05-06

astral-tokio-tar is Vulnerable to PAX Header Desynchronization

astral-sh/tokio-tar · GHSA-fp55-jw48-c537

high2026-05-06

CVE-2026-42339-QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0

quantumnous/new-api · GHSA-v5c3-6wvc-pc2q