Security advisories

high2026-05-05

CVE-2026-43885-AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

wwbn/avideo · GHSA-xr49-f4rh-qcjf

low2026-05-05

ciguard: Web UI is missing HTTP defence-in-depth headers

jo-jo98/ciguard · GHSA-7ww3-xvf5-cxwm

low2026-05-05

CVE-2026-44220-ciguard: discover_pipeline_files follows symlinks out of scan root

jo-jo98/ciguard · GHSA-8cxw-cc62-q28v

low2026-05-05

CVE-2026-44218-ciguard: Container image runs as root (no USER directive)

jo-jo98/ciguard · GHSA-jrm4-4pcf-4763

medium2026-05-05

CVE-2026-44219-ciguard: SCA HTTP client reads response body without size cap

jo-jo98/ciguard · GHSA-xw8c-rrvx-f7xq

medium2026-05-05

CVE-2026-44217-sse-channel: SSE Injection via unsanitized event fields

rexxars/sse-channel · GHSA-84hm-wfh8-c5pg

high2026-05-05

CVE-2026-43884-AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()

wwbn/avideo · GHSA-2hch-c97c-g99x

medium2026-05-05

CVE-2026-43883-AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

wwbn/avideo · GHSA-958h-qp3x-q4gj

high2026-05-05

jdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine

jdbi/jdbi · GHSA-mggx-p7jf-jgw4

medium2026-05-05

CVE-2026-43882-AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing

wwbn/avideo · GHSA-mwgh-92m2-wvhv

high2026-05-05

CVE-2026-6970-authd: Primary group ID is incorrectly set to value of UID

canonical/authd · GHSA-fg3j-5w9g-hmg7

medium2026-05-05

CVE-2026-43881-AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction

wwbn/avideo · GHSA-6rvw-7p8v-mjfq

medium2026-05-05

CVE-2026-42348-OpAMP client reads unbounded HTTP response bodies

open-telemetry/opentelemetry-dotnet-contrib · GHSA-w2jh-77fq-7gp8

medium2026-05-05

CVE-2026-43880-AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address

wwbn/avideo · GHSA-5hgj-7gm9-cff5

medium2026-05-05

CVE-2026-44903-Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display

prometheus/prometheus · GHSA-fw8g-cg8f-9j28

medium2026-05-05

GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens

rmosolgo/graphql-ruby · GHSA-3h96-34p3-xm76

medium2026-05-05

CVE-2026-42338-ip-address has XSS in Address6 HTML-emitting methods

beaugunderson/ip-address · GHSA-v2v4-37r5-5v8g

medium2026-05-05

CVE-2026-43879-AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass

wwbn/avideo · GHSA-wp38-whx3-xffh

medium2026-05-05

CVE-2026-42541-Kubewarden vulnerable to RBAC Reconnaissance via unchecked can_i host capability call

kubewarden/kubewarden-controller · GHSA-wqcw-g35j-j578

high2026-05-05

CVE-2026-42334-Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

automattic/mongoose · GHSA-wpg9-53fq-2r8h