Security advisories

high2026-05-06

CVE-2026-42283-DevSpace UI Server WebSocket CheckOrigin does not validate source

devspace-sh/devspace · GHSA-hqwm-7x7x-8379

high2026-05-06

CVE-2026-42280-Auth.js SDK has Improper Permission Checking

auth0/auth0.js · GHSA-8qjv-jj2q-x832

critical2026-05-06

CVE-2026-42238-Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore

0xjacky/nginx-ui · GHSA-4pvg-prr3-9cxr

medium2026-05-06

CVE-2026-42223-Nginx-UI Settings API Exposes Protected Secrets

0xjacky/nginx-ui · GHSA-q4w7-56hr-83rm

high2026-05-06

CVE-2026-42222-Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover

0xjacky/nginx-ui · GHSA-mxqh-q9h6-v8pq

high2026-05-06

CVE-2026-42221-Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

0xjacky/nginx-ui · GHSA-h27v-ph7w-m9fp

medium2026-05-06

CVE-2026-42184-Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands

tauri-apps/tauri · GHSA-7gmj-67g7-phm9

high2026-05-06

CVE-2026-33079-Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input

lepture/mistune · GHSA-8mp2-v27r-99xp

critical2026-05-06

CVE-2026-29090-Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API

rucio/rucio · GHSA-6j7p-qjhg-9947

critical2026-05-06

CVE-2026-29080-Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API

rucio/rucio · GHSA-vjr5-c9qv-hgm3

medium2026-05-06

CVE-2026-8026-Flowise: Bcrypt Password Hash Exposure

flowiseai/flowise · GHSA-8f47-4rh3-x44m

high2026-05-06

CVE-2026-43646-Apache Wicket has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability

apache/wicket · GHSA-jvv4-8wxx-m5r6

medium2026-05-06

CVE-2026-43975-Apache Wicket has a Path Traversal issue

apache/wicket · GHSA-3gmf-p6r4-q8m6

critical2026-05-06

CVE-2026-40010-Apache Wicket has a Session Fixation issue

apache/wicket · GHSA-qpjw-p3jg-59j6

medium2026-05-06

CVE-2026-42509-Apache Wicket has a Cross-site Scripting issue

apache/wicket · GHSA-5x9h-93gp-chpj

medium2026-05-06

CVE-2026-7572-Velocidex Velociraptor has an off-by-one error

velocidex/velociraptor · GHSA-6cmp-qv2f-x97x

medium2026-05-06

CVE-2026-7573-Velocidex Velociraptor has an authorization bypass vulnerability

velocidex/velociraptor · GHSA-3c93-g9g6-p5j4

low2026-05-06

CVE-2026-44405-Paramiko rsakey.py allows the SHA-1 algorithm

paramiko/paramiko · GHSA-r374-rxx8-8654

critical2026-05-05

CVE-2026-44221-ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases

arcadedata/arcadedb · GHSA-fxc7-fm93-6q77

medium2026-05-05

CVE-2026-44222-vLLM Vulnerable to Remote DoS via Special-Token Placeholders

vllm-project/vllm · GHSA-hpv8-x276-m59f