Security advisories

critical2026-05-04

`mysten-metrics` was removed from crates.io for malicious code

mystenlabs/sui · GHSA-g38r-8gmr-ghrf

critical2026-05-04

`sui-execution-cut` was removed from crates.io for malicious code

mystenlabs/sui · GHSA-qprh-m6p3-hwxc

high2026-05-04

CVE-2026-38751-OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality

devcode-it/openstamanager · GHSA-rm34-fg4m-39mw

critical2026-05-04

CVE-2026-42601-ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

archivebox/archivebox · GHSA-3h23-7824-pj8r

high2026-05-04

CVE-2026-42575-apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

chainguard-dev/apko · GHSA-hcwr-pq9g-rq3m

high2026-05-04

CVE-2026-42574-apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

chainguard-dev/apko · GHSA-qq3r-w4hj-gjp6

medium2026-05-04

CVE-2026-42576-apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

chainguard-dev/apko · GHSA-m7hm-vm4x-28jf

critical2026-05-04

CVE-2026-42571-Pelican Web UI Affected by a Privilege Escalation Attack

pelicanplatform/pelican · GHSA-rpfr-x88x-xwcw

critical2026-05-04

CVE-2026-42569-phpVMS has an /importer authorization bypass causing full database wipe

phpvms/phpvms · GHSA-fv26-4939-62fh

high2026-05-04

AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field

azuracast/azuracast · GHSA-q4ph-8x8g-95f8

medium2026-05-04

AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration

azuracast/azuracast · GHSA-qff7-q5fm-8p76

medium2026-05-04

AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption

azuracast/azuracast · GHSA-4fm3-ggg2-c6qx

high2026-05-04

CVE-2026-42606-AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass

azuracast/azuracast · GHSA-gv7r-3mr9-h5x8

high2026-05-04

CVE-2026-42605-AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

azuracast/azuracast · GHSA-vp2f-cqqp-478j

medium2026-05-04

CVE-2026-42333-quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations

quarkiverse/quarkus-openapi-generator · GHSA-fr8f-rwjx-f32v

critical2026-05-04

CVE-2026-41901-Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

thymeleaf/thymeleaf · GHSA-c9ph-gxww-7744

medium2026-05-04

OpenClaw's Gateway Control UI bootstrap config required Gateway auth

openclaw/openclaw · GHSA-93rg-2xm5-2p9v

medium2026-05-04

CVE-2026-44113-OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes

openclaw/openclaw · GHSA-5h3g-6xhh-rg6p

medium2026-05-04

CVE-2026-44112-OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root

openclaw/openclaw · GHSA-wppj-c6mr-83jj

high2026-05-04

CVE-2026-41895-changedetection.io project has an XXE vulnerability

dgtlmoon/changedetection.io · GHSA-v7cp-2cx9-x793