Security advisories

low2026-04-22

CVE-2026-35344-uutils coreutils has an Unchecked Return Value Issue

uutils/coreutils · GHSA-wh8p-h9hw-x2mc

medium2026-04-22

CVE-2026-35360-uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

uutils/coreutils · GHSA-q6m9-xj2w-xmrc

high2026-04-22

CVE-2026-35368-uutils coreutils has an Untrusted Search Path

uutils/coreutils · GHSA-mh5c-xrmh-m794

medium2026-04-22

CVE-2026-35364-uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

uutils/coreutils · GHSA-m976-87wm-48fm

medium2026-04-22

CVE-2026-35359-uutils coreutils has a Link Following issue

uutils/coreutils · GHSA-hpfw-mqm3-33jh

medium2026-04-22

CVE-2026-35348-uutils coreutils has an Uncaught Exception When Encountering Valid but Non-UTF-8 Paths

uutils/coreutils · GHSA-f2jv-wjjc-2c94

high2026-04-22

CVE-2026-35352-uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition

uutils/coreutils · GHSA-9gh9-hwpr-rvqq

medium2026-04-22

CVE-2026-35351-uutils coreutils doesn't preserve file ownership during moves across different filesystem boundaries

uutils/coreutils · GHSA-957r-r8gc-vv3h

low2026-04-22

CVE-2026-35367-uutils coreutils has an Incorrect Permission Assignment for Critical Resource

uutils/coreutils · GHSA-5hgf-628x-mcqf

medium2026-04-22

CVE-2026-35357-uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

uutils/coreutils · GHSA-2m8x-mvfx-gwgj

medium2026-04-22

CVE-2026-35345-uutils coreutils has a Link Following Issue

uutils/coreutils · GHSA-xf75-659h-cgg5

medium2026-04-22

CVE-2026-30139-Silverpeas Core has a reflected cross-site scripting vulnerability

silverpeas/silverpeas-core · GHSA-vmj7-7xmm-4349

medium2026-04-22

CVE-2026-24905-Inspektor Gadget: Command Injection via malicious buildOptions manipulation

inspektor-gadget/inspektor-gadget · GHSA-79qw-g77v-2vfh

high2026-04-22

CVE-2026-41693-i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite

i18next/i18next-fs-backend · GHSA-8847-338w-5hcj

medium2026-04-22

CVE-2026-41692-i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes

i18next/i18nextify · GHSA-6457-mxpq-4fqq

medium2026-04-22

CVE-2026-41691- i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns

i18next/i18next-http-backend · GHSA-q89c-q3h5-w34g

high2026-04-22

CVE-2026-41690-i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters

i18next/i18next-http-middleware · GHSA-5fgg-jcpf-8jjw

high2026-04-22

CVE-2026-41422-Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API

daptin/daptin · GHSA-rw2c-8rfq-gwfv

medium2026-04-22

CVE-2026-41240-DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

cure53/dompurify · GHSA-h7mw-gpvr-xq4m

medium2026-04-22

CVE-2026-41239-DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

cure53/dompurify · GHSA-crv5-9vww-q3g8