Security advisories

critical2026-04-16

CVE-2026-54334-UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen

theopolis/uefi-firmware-parser · GHSA-hm2w-vr2p-hq7w

critical2026-04-16

CVE-2026-54333-UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable

theopolis/uefi-firmware-parser · GHSA-2689-5p89-6j3j

medium2026-04-16

CVE-2026-40594-pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)

pyload/pyload · GHSA-mp82-fmj6-f22v

medium2026-04-16

CVE-2026-41182-LangSmith SDK: Streaming token events bypass output redaction

langchain-ai/langsmith-sdk · GHSA-rr7j-v2q5-chgv

medium2026-04-16

CVE-2026-41206-PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code

parzivalhack/pyspector · GHSA-vp22-38m5-r39r

critical2026-04-16

CVE-2026-32179-MsQuic has a Remote Elevation of Privilege Vulnerability

microsoft/msquic · GHSA-gvvw-8j96-8g5r

critical2026-04-16

CVE-2026-33808-@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

fastify/fastify-express · GHSA-6hw5-45gm-fj88

critical2026-04-16

CVE-2026-33807-@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes

fastify/fastify-express · GHSA-hrwm-hgmj-7p9c

critical2026-04-16

CVE-2026-33805-Fastify's connection header abuse enables stripping of proxy-added headers

fastify/fastify-reply-from · GHSA-gwhp-pf74-vj37

high2026-04-16

CVE-2026-41211- Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME

voidzero-dev/vite-plus · GHSA-33r3-4whc-44c2

medium2026-04-16

CVE-2026-56761-hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR

honojs/hono · GHSA-458j-xx4x-4375

critical2026-04-16

CVE-2026-41228-Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution

froxlor/froxlor · GHSA-w59f-67xm-rxx7

medium2026-04-16

CVE-2026-40500-ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature

processwire/processwire · GHSA-gmwr-9j4p-96vm

critical2026-04-16

CVE-2026-41229-Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

froxlor/froxlor · GHSA-gc9w-cc93-rjv8

high2026-04-16

CVE-2026-41230-Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()

froxlor/froxlor · GHSA-47hf-23pw-3m8c

high2026-04-16

CVE-2026-41231-Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron

froxlor/froxlor · GHSA-75h4-c557-j89r

medium2026-04-16

CVE-2026-41232-Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing

froxlor/froxlor · GHSA-vmjj-qr7v-pxm6

medium2026-04-16

CVE-2026-41233-Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()

froxlor/froxlor · GHSA-jvx4-xv3m-hrj4

medium2026-04-16

CVE-2026-65903-DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

cure53/dompurify · GHSA-39q2-94rc-95cp

low2026-04-15

CVE-2026-21727-Grafana legacy correlations allow cross-tenant disclosure and deletion

grafana/grafana · GHSA-p5x9-j974-rpfp