Security advisories

high2026-05-05

CVE-2026-42856-Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls

jovancoding/network-ai · GHSA-fj4g-2p96-q6m3

high2026-05-05

webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input

webonyx/graphql-php · GHSA-r7cg-qjjm-xhqq

medium2026-05-05

ots has a negative expire override that can bypass its secret retention policy

luzifer/ots · GHSA-h5fq-653g-gxrm

medium2026-05-05

CVE-2026-41164-nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token

nuts-foundation/nuts-node · GHSA-9hmg-827w-9rhj

high2026-05-05

CVE-2026-40934-Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart

jupyter-server/jupyter_server · GHSA-5mrq-x3x5-8v8f

high2026-05-05

CVE-2026-40110-Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`

jupyter-server/jupyter_server · GHSA-24qx-w28j-9m6p

high2026-05-05

CVE-2026-35397-Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to sibling directories

jupyter-server/jupyter_server · GHSA-5789-5fc7-67v3

critical2026-05-05

CVE-2026-26956-VM2 Has a WASM Sandbox Escape

patriksimek/vm2 · GHSA-ffh4-j6h5-pg66

critical2026-05-05

CVE-2026-26332-VM2 Has a Sandbox Escape Issue via SuppressedError

patriksimek/vm2 · GHSA-55hx-c926-fr95

critical2026-05-05

CVE-2026-24781-VM2 Has Sandbox Breakout Through Inspect Function

patriksimek/vm2 · GHSA-v37h-5mfm-c47c

medium2026-05-05

CVE-2025-61669-Jupyter Server has an open redirection vulnerability in `next` query parameter

jupyter-server/jupyter_server · GHSA-qh7q-6qm3-653w

critical2026-05-05

CVE-2026-24120-VM2 Has Sandbox Breakout Through Promise Species

patriksimek/vm2 · GHSA-qvjj-29qf-hp7p

medium2026-05-05

CVE-2026-43570-OpenClaw contains a symlink traversal vulnerability

openclaw/openclaw · GHSA-35mw-5vvr-vrxc

high2026-05-05

CVE-2026-43869-Apache Thrift has an Improper Validation of Certificate with Host Mismatch Vulnerability

apache/thrift · GHSA-7pwc-h2j2-rjgj

high2026-05-05

CVE-2026-43870-Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption

apache/thrift · GHSA-526f-jxpj-jmg2

medium2026-05-05

CVE-2026-43868-Apache Thrift has a Memory Allocation with Excessive Size Value Vulnerability

apache/thrift · GHSA-2f9f-gq7v-9h6m

medium2026-05-05

CVE-2026-42037-Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

axios/axios · GHSA-445q-vr5w-6q77

medium2026-05-05

CVE-2026-42038-Axios: no_proxy bypass via IP alias allows SSRF

axios/axios · GHSA-m7pr-hjqh-92cm

medium2026-05-05

CVE-2026-42039-Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

axios/axios · GHSA-62hf-57xw-28j9

medium2026-05-05

CVE-2026-42034-Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

axios/axios · GHSA-5c9x-8gcm-mpgx