Security advisories

high2026-05-05

CVE-2026-7776-Hashicorp Boundary workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes

hashicorp/boundary · GHSA-7x9r-wcgg-w86f

medium2026-05-05

CVE-2026-42036-Axios: HTTP adapter streamed responses bypass maxContentLength

axios/axios · GHSA-vf2m-468p-8v99

high2026-05-05

CVE-2026-42033-Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

axios/axios · GHSA-pf86-5x62-jrwf

high2026-05-05

CVE-2026-42035-Axios: Header Injection via Prototype Pollution

axios/axios · GHSA-6chq-wfr3-2hj9

medium2026-05-05

CVE-2026-42042-Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

axios/axios · GHSA-xx6v-rp6x-q39c

medium2026-05-05

CVE-2026-42041-Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

axios/axios · GHSA-w9j2-pvgh-6h63

high2026-05-05

CVE-2026-42043-Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

axios/axios · GHSA-pmwg-cvhr-8vh7

medium2026-05-05

CVE-2026-42044-Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

axios/axios · GHSA-3w6x-2g7m-8v23

high2026-05-05

CVE-2026-42264-Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

axios/axios · GHSA-q8qp-cvcw-x6jj

low2026-05-05

CVE-2026-42040-Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

axios/axios · GHSA-xhjh-pmcv-23jw

medium2026-05-05

ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key

ogham-mcp/ogham-mcp · GHSA-8pqq-224h-x875

high2026-05-04

webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments

webonyx/graphql-php · GHSA-fc86-6rv6-2jpm

high2026-05-04

livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler

mckenziearts/livewire-markdown-editor · GHSA-gxxh-8vcj-w2mh

high2026-05-04

CVE-2026-42313-pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

pyload/pyload · GHSA-pg67-9wjv-mr85

medium2026-05-04

CVE-2026-42312-pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

pyload/pyload · GHSA-ccxc-x975-4hh9

medium2026-05-04

CVE-2026-42257-net-imap vulnerable to command Injection via "raw" arguments to multiple commands

ruby/net-imap · GHSA-hm49-wcqc-g2xg

medium2026-05-04

CVE-2026-42258-net-imap vulnerable to command Injection via unvalidated Symbol inputs

ruby/net-imap · GHSA-75xq-5h9v-w6px

medium2026-05-04

CVE-2026-42256-net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

ruby/net-imap · GHSA-87pf-fpwv-p7m7

low2026-05-04

CVE-2026-42245-net-imap has quadratic complexity when reading response literals

ruby/net-imap · GHSA-q2mw-fvj9-vvcw

high2026-05-04

CVE-2026-42246-net-imap vulnerable to STARTTLS stripping via invalid response timing

ruby/net-imap · GHSA-vcgp-9326-pqcp