Security advisories

low2026-04-16

webpki: Name constraints were accepted for certificates asserting a wildcard name

rustls/webpki · GHSA-xgp8-3hg3-c2mh

high2026-04-16

CVE-2026-41205-Mako: Path traversal via double-slash URI prefix in TemplateLookup

sqlalchemy/mako · GHSA-v92g-xgxw-vvmm

low2026-04-16

webpki: Name constraints for URI names were incorrectly accepted

rustls/webpki · GHSA-965h-392x-2mh5

medium2026-04-16

CVE-2026-41245-Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

junrar/junrar · GHSA-hf5p-q87m-crj7

high2026-04-16

CVE-2026-41180-PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart

psi-4ward/psitransfer · GHSA-533q-w4g6-5586

medium2026-04-16

CVE-2026-41244-Mojic: Observable Timing Discrepancy in HMAC Verification

notamitgamer/mojic · GHSA-wqq3-wfmp-v85g

medium2026-04-16

CVE-2026-41213-@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

node-oauth/node-oauth2-server · GHSA-jhm7-29pj-4xvf

critical2026-04-16

CVE-2026-40324-ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents

chillicream/graphql-platform · GHSA-qr3m-xw4c-jqw3

medium2026-04-16

CVE-2026-40304-zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records

openziti/zrok · GHSA-3jpj-v3xr-5h6g

high2026-04-16

CVE-2026-40303-zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing

openziti/zrok · GHSA-cpf9-ph2j-ccr9

medium2026-04-16

CVE-2026-40302-zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering

openziti/zrok · GHSA-4fxq-2x3x-6xqx

medium2026-04-16

CVE-2026-40256-Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

weblateorg/weblate · GHSA-ffgh-3jrf-8wvh

medium2026-04-16

CVE-2026-40186-sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements

apostrophecms/apostrophe · GHSA-9mrh-v2v3-xpfm

critical2026-04-16

CVE-2026-40173-Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints

dgraph-io/dgraph · GHSA-95mq-xwj4-r47p

medium2026-04-16

CVE-2026-39857-ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions

apostrophecms/apostrophe · GHSA-c276-fj82-f2pq

medium2026-04-16

CVE-2026-39845-Weblate: SSRF via the webhook add-on using unprotected fetch_url()

weblateorg/weblate · GHSA-f8hv-g549-hwg2

medium2026-04-16

CVE-2026-39350-Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots

istio/istio · GHSA-9gcg-w975-3rjh

high2026-04-16

CVE-2026-39313-MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport

quantgeekdev/mcp-framework · GHSA-353c-v8x9-v7c3

high2026-04-16

CVE-2026-35569-Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS

apostrophecms/apostrophe · GHSA-855c-r2vq-c292

high2026-04-16

CVE-2026-35469-SpdyStream: DOS on CRI

moby/spdystream · GHSA-pc3f-x583-g7j2