Security advisories

high2026-05-05

@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts

evomap/evolver · GHSA-jxh8-jh77-xh6g

medium2026-05-05

@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS

evomap/evolver · GHSA-7xp7-m392-h92c

high2026-05-05

@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)

evomap/evolver · GHSA-cfcj-hqpf-hccf

high2026-05-05

Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled

apernet/hysteria · GHSA-9fw6-xgg2-mq9q

medium2026-05-05

CVE-2026-42314-PyLoad Vulnerable to Path Traversal via Package Folder Name

pyload/pyload · GHSA-97r3-5w84-r4q8

high2026-05-05

CVE-2026-42304-Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains

twisted/twisted · GHSA-grgv-6hw6-v9g4

medium2026-05-05

CVE-2026-42303-Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection

ethyca/fides · GHSA-qx5f-ghc2-7g5c

critical2026-05-05

CVE-2026-42300-DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

l3montree-dev/devguard · GHSA-2g9v-7mr5-fgjg

high2026-05-05

CVE-2026-42285-GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)

osrg/gobgp · GHSA-p3w2-64xm-833j

critical2026-05-05

CVE-2026-42281-MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint

magicmirrororg/magicmirror · GHSA-ph6f-2cvq-79hq

medium2026-05-05

CVE-2026-42267-Kimai vulnerable to formula Injection via tag names in XLSX export

kimai/kimai · GHSA-3xc2-h5r3-wv3r

high2026-05-05

CVE-2026-42266-JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request

jupyterlab/jupyterlab · GHSA-37w4-hwhx-4rc4

high2026-05-05

CVE-2026-42260-open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`

aas-ee/open-websearch · GHSA-v228-72c7-fx8j

medium2026-05-05

CVE-2026-42220-Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback

0xjacky/nginx-ui · GHSA-7jrr-xw9c-mj39

high2026-05-05

CVE-2026-43939-YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers

yafnet/yafnet · GHSA-8rq5-wwpp-fmj2

high2026-05-05

CVE-2026-43937-YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`

yafnet/yafnet · GHSA-xhw7-j96h-c3g5

high2026-05-05

CVE-2026-43938-YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

yafnet/yafnet · GHSA-33gv-fc78-qgf5

low2026-05-05

CVE-2026-43930-parse-server: MFA SMS one-time password accepted twice under concurrent login

parse-community/parse-server · GHSA-jpq4-7fmq-q5fj

high2026-05-05

CVE-2026-43929-ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs

felippe-regazio/ssrfcheck · GHSA-j4rj-2jr5-m439

high2026-05-05

CVE-2025-8267-ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid

felippe-regazio/ssrfcheck · GHSA-p4hc-9pjh-55c8