Security Advisories

medium2026-10-06

CVE-2026-102414-pbkdf2 rehashes long passwords on every iteration, enabling denial of service

medium2026-10-06

Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

View chart

langflow-ai/langflow · GHSA-j8f7-x8jm-wmm4

critical2026-10-06

CVE-2026-10561-Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation

View chart

langflow-ai/langflow · GHSA-8qpj-27x8-pwpq

medium2026-10-06

CVE-2026-105750-Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

View chart

docling-project/docling · GHSA-q43m-vhcp-mhvm

medium2026-10-06

CVE-2026-105753-vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

View chart

vllm-project/vllm · GHSA-ph3r-5jfg-f84f

low2026-10-06

CVE-2026-105752-vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

View chart

vllm-project/vllm · GHSA-935w-9g4m-p28p

medium2026-10-05

CVE-2026-102598-Werkzeug safe_join() allows Windows special device names

View chart

pallets/werkzeug · GHSA-g6x2-hccm-hh4m

critical2026-10-05

CVE-2026-102829-simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

View chart

steveukx/git-js · GHSA-v5rq-49vh-5v5c

critical2026-10-05

CVE-2026-102828-simple-git unsafe-operation guard does not block trailer command configuration

View chart

steveukx/git-js · GHSA-x6jw-m9v5-85vh

high2026-10-05

CVE-2026-102826-simple-git allows command execution through unblocked Git configuration includes

View chart

steveukx/git-js · GHSA-g4wm-2vf7-vfgr

high2026-10-05

CVE-2026-102827-simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

View chart

steveukx/git-js · GHSA-858h-whjf-mvg5

high2026-10-05

CVE-2026-96749-PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding

View chart

mongodb/mongo-python-driver · GHSA-v4x9-3549-crwv

high2026-10-05

CVE-2026-96748-PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

View chart

mongodb/mongo-python-driver · GHSA-vp6j-j7w5-5xjj

medium2026-10-05

CVE-2026-96747-PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption

View chart

mongodb/mongo-python-driver · GHSA-qx36-8mw2-4r3x

high2026-10-05

CVE-2026-102600-Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

View chart

socketio/socket.io · GHSA-wfpm-5gcm-94cg

medium2026-10-05

CVE-2026-104181-Filament: Multi-factor authentication (app) management actions do not require password reauthentication

View chart

filamentphp/filament · GHSA-7m6h-rg42-m449

medium2026-10-05

CVE-2026-102275-PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

View chart

jpadilla/pyjwt · GHSA-x33g-cr3x-6449

low2026-10-05

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

View chart

cure53/dompurify · GHSA-6688-9rhm-gjv2

medium2026-10-05

CVE-2026-105758-vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

View chart

vllm-project/vllm · GHSA-x6mc-67gf-chw4

medium2026-10-05

CVE-2026-105760-vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

View chart

vllm-project/vllm · GHSA-58v5-2m8f-94pr