Security advisories

high2026-04-22

MCPHub has Path Traversal via Malicious MCPB Manifest Name

samanhappy/mcphub · GHSA-p3h2-2j4p-p83g

low2026-04-22

CVE-2026-41889-pgx: SQL Injection via placeholder confusion with dollar quoted string literals

jackc/pgx · GHSA-j88v-2chj-qfwx

medium2026-04-22

Gitea has insecure default SSH settings

go-gitea/gitea · GHSA-3m6q-h5gj-7mrw

medium2026-04-22

CVE-2026-41887-Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)

flarum/framework · GHSA-xjvc-pw2r-6878

high2026-04-22

CVE-2026-41886-locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor

locize/locize · GHSA-w937-fg2h-xhq2

medium2026-04-22

CVE-2026-41885-i18next-locize-backend has URL Injection via Unsanitized Path Parameters

locize/i18next-locize-backend · GHSA-mgcp-mfp8-3q45

high2026-04-22

CVE-2026-41683-i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header

i18next/i18next-http-middleware · GHSA-c3h8-g69v-pjrg

high2026-04-22

CVE-2026-41673-xmldom: Uncontrolled recursion in XML serialization leads to DoS

xmldom/xmldom · GHSA-2v35-w6hq-6mfw

high2026-04-22

CVE-2026-41674-xmldom has XML injection through unvalidated DocumentType serialization

xmldom/xmldom · GHSA-f6ww-3ggp-fr8h

high2026-04-22

CVE-2026-41675-xmldom has XML node injection through unvalidated processing instruction serialization

xmldom/xmldom · GHSA-x6wf-f3px-wcqx

high2026-04-22

CVE-2026-41672-xmldom has XML node injection through unvalidated comment serialization

xmldom/xmldom · GHSA-j759-j44w-7fr8

high2026-04-22

CVE-2026-41640-@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading

nocobase/nocobase · GHSA-4948-f92q-f432

high2026-04-22

CVE-2026-41641-@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call

nocobase/nocobase · GHSA-wrwh-c28m-9jjh

medium2026-04-22

CVE-2026-41650-fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

naturalintelligence/fast-xml-parser · GHSA-gh4j-gqv2-49f6

medium2026-04-22

CVE-2026-41645-Nuclei: Environment variable disclosure via Response-Derived DSL Expressions

projectdiscovery/nuclei · GHSA-jm34-66cf-qpvr

medium2026-04-22

CVE-2026-41646-Nuclei: Local File Read via require() Module Loader Bypass

projectdiscovery/nuclei · GHSA-29rg-wmcw-hpf4

high2026-04-22

CVE-2026-41644-monetr: Server-side request forgery in Lunch Flow link creation and refresh

monetr/monetr · GHSA-29v9-frvh-c426

medium2026-04-22

CVE-2026-41591-Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping

marko-js/marko · GHSA-x9fj-57fh-c8wq

medium2026-04-22

CVE-2026-41136-free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer

free5gc/free5gc · GHSA-r99v-75p9-xqm5

high2026-04-22

CVE-2026-41135-free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service

free5gc/free5gc · GHSA-98cp-84m9-q3qp