Security advisories

medium2026-04-30

CVE-2026-7446-mcp-server-semgrep has a Command Injection issue

vetcoders/mcp-server-semgrep · GHSA-86hp-qxqp-w9wv

high2026-04-29

CVE-2026-42031-CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`

ckan/ckan · GHSA-h7j7-3rx6-xvcg

medium2026-04-29

CVE-2026-41686-Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool

anthropics/anthropic-sdk-typescript · GHSA-p7fg-763f-g4gf

high2026-04-29

CVE-2026-42353-i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters

i18next/i18next-http-middleware · GHSA-jfgf-83c5-2c4m

medium2026-04-29

netfoil's optional seccomp sandboxing was not applied

tinfoil-factory/netfoil · GHSA-vjgj-42f6-7997

medium2026-04-29

Netfoil has incorrect allowlist enforcement

tinfoil-factory/netfoil · GHSA-84g5-x8j3-7235

high2026-04-29

CVE-2026-42352-pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

geopython/pygeoapi · GHSA-jgvc-94c8-3chc

high2026-04-29

CVE-2026-42351-pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider

geopython/pygeoapi · GHSA-f6pr-83pg-ghh6

high2026-04-29

CVE-2026-41680-Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer

markedjs/marked · GHSA-6v9c-7cg6-27q7

medium2026-04-29

CVE-2026-41671-Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation

admidio/admidio · GHSA-9xx5-cv6j-x533

high2026-04-29

CVE-2026-41670-Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest

admidio/admidio · GHSA-p9w9-87c8-m235

high2026-04-29

CVE-2026-41669-Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests

admidio/admidio · GHSA-25cw-98hg-g3cg

low2026-04-29

CVE-2026-41663-Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send

admidio/admidio · GHSA-rw74-vc9h-534j

medium2026-04-29

CVE-2026-41662-Admidio Missing Minimum Administrator Check in Role Membership Removal

admidio/admidio · GHSA-c7xm-r6vj-8vg6

medium2026-04-29

CVE-2026-41661-Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion

admidio/admidio · GHSA-gq27-fc8w-vcmp

high2026-04-29

CVE-2026-41660-Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP

admidio/admidio · GHSA-rh3w-4ccx-prf9

low2026-04-29

CVE-2026-41659-Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment

admidio/admidio · GHSA-68pr-7prh-mpv4

medium2026-04-29

CVE-2026-41658-Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items

admidio/admidio · GHSA-xqv4-xm7h-52cv

medium2026-04-29

CVE-2026-41657-Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php

admidio/admidio · GHSA-g8p8-94f2-28gr

medium2026-04-29

CVE-2026-41656-Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read

admidio/admidio · GHSA-m9h6-8pqm-xrhf