Security advisories

low2026-05-03

CVE-2026-7688-Dolibarr has an Injection issue

dolibarr/dolibarr · GHSA-rvwr-q5hj-wq7g

low2026-05-03

CVE-2026-7689-Dolibarr has Insufficient Verification of Data Authenticity

dolibarr/dolibarr · GHSA-jggh-5rmh-r6h5

medium2026-05-03

CVE-2026-7669-SGLang has an Improper Input Validation/Injection Issue

sgl-project/sglang · GHSA-6m5f-673f-5vh7

medium2026-05-02

CVE-2026-7645-sublinear-time-solver has a Path Traversal Issue

ruvnet/sublinear-time-solver · GHSA-gc2j-wpjv-jhrw

low2026-05-02

CVE-2026-7600-yii2-mcp-server has a Command Injection Issue

artmin96/yii2-mcp-server · GHSA-gc8w-x73w-p4rh

low2026-05-02

CVE-2026-7597-mem0ai mem0 has an Improper Input Validation Issue

mem0ai/mem0 · GHSA-xqxw-r767-67m7

medium2026-05-01

CVE-2026-42475-MixPHP Framework has an SQL injection vulnerability

mix-php/mix · GHSA-vf35-8m4j-gm8v

medium2026-05-01

CVE-2026-42474-MixPHP Framework has an SQL injection vulnerability via crafted `data` array

mix-php/mix · GHSA-q57j-rwwx-7rwp

critical2026-05-01

CVE-2026-42779-Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)

apache/mina · GHSA-vf5j-865m-mq7c

medium2026-05-01

CVE-2026-7579-AstrBot Makes Use of Hard-coded Password

astrbotdevs/astrbot · GHSA-mq9q-25hm-g4gp

critical2026-05-01

CVE-2026-42778-Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41409 Incomplete Fix)

apache/mina · GHSA-995c-6rp3-4m4x

medium2026-05-01

CVE-2026-42404-Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API

apache/ws-neethi · GHSA-287c-fxr7-3w6c

high2026-05-01

CVE-2026-43003-OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere

openstack/ironic-python-agent · GHSA-rmxr-45gj-889w

medium2026-05-01

CVE-2026-40201-@diplodoc/search-extension allows stored XSS via Markdown file title

diplodoc-platform/search-extension · GHSA-rjmp-rwj4-mv82

high2026-05-01

CVE-2026-42402-Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization

apache/ws-neethi · GHSA-g36m-9g3m-2vmp

high2026-05-01

CVE-2026-42403-Apache Neethi does not properly detect circular references in policy definitions.

apache/ws-neethi · GHSA-2hfh-9h53-qc24

high2026-04-30

CVE-2026-42137-Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API

getkirby/kirby · GHSA-85x2-r8xv-ww8c

low2026-04-30

ps_checkout allows unauthorized method invocation through unvalidated parameter

prestashopcorp/ps_checkout · GHSA-mqq7-wxx5-mp8h

high2026-04-30

Contras Affected by CopyFile Policy Subversion via Symlinks

edgelesssys/contrast · GHSA-rh99-wc69-c255

high2026-04-30

CVE-2026-42461-Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

getarcaneapp/arcane · GHSA-cxx3-hr75-4q96