Security advisories

high2026-05-05

CVE-2026-40034-gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

gitoxidelabs/gitoxide · GHSA-f26g-jm89-4g65

high2026-05-05

gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure

gitoxidelabs/gitoxide · GHSA-p3hw-mv63-rf9w

medium2026-05-05

gix-transport: HTTP credentials leaked to redirected host in curl backend

gitoxidelabs/gitoxide · GHSA-9857-6mw7-fq2m

medium2026-05-05

CVE-2026-43878-Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal

wwbn/avideo · GHSA-mm5f-8q57-4fc4

medium2026-05-05

CVE-2026-43877-AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content

wwbn/avideo · GHSA-jw8g-5j46-44rp

medium2026-05-05

CVE-2026-43876-AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers

wwbn/avideo · GHSA-g9cm-rxp7-6gv5

medium2026-05-05

CVE-2026-43875-AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover

wwbn/avideo · GHSA-5w8w-26ch-v5cw

high2026-05-05

CVE-2026-43874-AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass

wwbn/avideo · GHSA-ghcv-22jf-vfxm

high2026-05-05

CVE-2026-43873-AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server

wwbn/avideo · GHSA-qm9p-p5pw-jrx2

medium2026-05-05

CVE-2026-42080-PPTAgent: Arbitrary File Write via `save_generated_slides`

icip-cas/pptagent · GHSA-pxhg-7xr2-w7xg

high2026-05-05

CVE-2026-42079-PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope

icip-cas/pptagent · GHSA-89g2-xw5c-v95p

medium2026-05-05

CVE-2026-42078-PPTAgent: Arbitrary File Write + Directory Creation via markdown_table_to_image

icip-cas/pptagent · GHSA-hrcw-xc63-g29m

critical2026-05-05

CVE-2026-42882-S3-Proxy has Security Issues in its Resource Path Matching Implementation

oxyno-zeta/s3-proxy · GHSA-rfgq-wgg8-662p

high2026-05-05

CVE-2026-6967-awslabs/tough is Missing Delegated Metadata Validation

awslabs/tough · GHSA-4v58-8p28-2rq3

high2026-05-05

CVE-2026-6966-awslabs/tough Delegated Roles have a Signature Threshold Bypass

awslabs/tough · GHSA-8m7c-8m39-rv4x

high2026-05-05

OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

openclaw/openclaw · GHSA-cwj3-vqpp-pmxr

high2026-05-05

CVE-2026-45004-OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution

openclaw/openclaw · GHSA-r39h-4c2p-3jxp

medium2026-05-05

CVE-2026-45005-OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload

openclaw/openclaw · GHSA-q8ff-7ffm-m3r9

medium2026-05-05

CVE-2026-42565-@workos/authkit-session has an Open Redirect via state-derived redirect target

workos/authkit-session · GHSA-vvvv-983w-r7pv

medium2026-05-05

CVE-2026-42875-External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

external-secrets/external-secrets · GHSA-wv26-88m5-6h59