Security advisories

medium2026-05-05

CVE-2026-43901-wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured

bx33661/wireshark-mcp · GHSA-3r68-x3xc-rxpg

high2026-05-05

RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover

rustfs/rustfs · GHSA-mm2q-qcmx-gw4w

medium2026-05-05

CVE-2026-42554-Fiber vulnerable to XSS in AutoFormat Content Negotiation

gofiber/fiber · GHSA-qjv7-627w-8qjv

high2026-05-05

CVE-2026-43897-link-preview-js vulnerable to IPv6 and internal loopback attacks

op-engineering/link-preview-js · GHSA-4gp8-rjrq-ch6q

medium2026-05-05

CVE-2026-42207-Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`

openmage/magento-lts · GHSA-qpgq-5g92-j5q8

high2026-05-05

CVE-2026-42198-pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

pgjdbc/pgjdbc · GHSA-98qh-xjc8-98pq

critical2026-05-05

CVE-2026-42196-django-s3file is vulnerable to relative path traversal

codingjoe/django-s3file · GHSA-67qg-7284-2277

medium2026-05-05

CVE-2026-42600-MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

minio/minio · GHSA-xh8f-g2qw-gcm7

medium2026-05-05

CVE-2026-42194-Admidio has an incomplete fix for CVE-2026-32812 (SSRF)

admidio/admidio · GHSA-hcjj-chvw-fmw9

low2026-05-05

CVE-2026-42188-Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser

geysermc/geyser · GHSA-xcfg-fcr5-gw9r

low2026-05-05

CVE-2026-42186-OpenBao's Namespace Deletion May Not Delete Data Properly

openbao/openbao · GHSA-vv66-6rp4-wr4f

high2026-05-05

CVE-2026-43893-exiftool-vendored vulnerable to argument injection via newline characters in tag names

photostructure/exiftool-vendored.js · GHSA-cw26-7653-2rp5

medium2026-05-05

CVE-2026-42175-requests-hardened is Vulnerable to Server-Side Request Forgery

saleor/requests-hardened · GHSA-vh75-fwv3-pqrh

critical2026-05-05

CVE-2026-42155-Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

openmage/magento-lts · GHSA-2cwr-gcf9-pvxr

high2026-05-05

CVE-2026-42154-Prometheus: Remote read endpoint allows denial of service via crafted snappy payload

prometheus/prometheus · GHSA-8rm2-7qqf-34qm

high2026-05-05

CVE-2026-42151-Prometheus Azure AD remote write OAuth client secret exposed via config API

prometheus/prometheus · GHSA-wg65-39gg-5wfj

medium2026-05-05

CVE-2026-42140-XWiki PlantUML Macro Vulnerable to Server-Side Request Forgery (SSRF) via 'server' parameter

xwiki-contrib/macro-plantuml · GHSA-42fc-7w97-8vrc

high2026-05-05

gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository

gitoxidelabs/gitoxide · GHSA-fr8x-3vfx-f45h

high2026-05-05

gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository

gitoxidelabs/gitoxide · GHSA-pg4w-g64p-qwhj

high2026-05-05

gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data

gitoxidelabs/gitoxide · GHSA-x494-mj8g-cj27