Security Advisories

high2026-10-23

Strands Agents SDK: Exposure of data element to wrong session in the A2A Server

strands-agents/harness-sdk · GHSA-4v6f-7vjh-6x4m · CVE-2026-115419

high2026-10-23

virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

pypa/virtualenv · GHSA-cx6f-vjhg-g3cc · CVE-2026-115586

high2026-10-23

Mistune: Path Traversal and XSS in Include directive

lepture/mistune · GHSA-h7ww-273w-6cm8 · CVE-2026-115355

medium2026-10-23

Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

twisted/twisted · GHSA-2qrf-pqgx-qh9v · CVE-2026-115774

high2026-10-23

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

twisted/twisted · GHSA-53xc-49m8-p798 · CVE-2026-115776

high2026-10-23

Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

twisted/twisted · GHSA-cwm5-jh59-mwxr · CVE-2026-115778

high2026-10-23

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

twisted/twisted · GHSA-3476-c5c2-fr73 · CVE-2026-115775

medium2026-10-23

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

twisted/twisted · GHSA-q7qq-6mhp-9rc4 · CVE-2026-115877

medium2026-10-23

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

vllm-project/vllm · GHSA-p92p-rxj5-7p2x · CVE-2026-114050

low2026-10-23

SvelteKit : XSS via untrusted cache-control header in prerendered page

sveltejs/kit · GHSA-27mw-82g8-phjj · CVE-2026-114061

high2026-10-23

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

the-40-thieves/obsidian-tc · GHSA-r3g7-r4hr-m258 · CVE-2026-115478

medium2026-10-23

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

siyuan-note/siyuan · GHSA-rpx2-p6hp-x5gj · CVE-2026-62204

high2026-10-23

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream

siyuan-note/siyuan · GHSA-c8w8-3pqp-wr83 · CVE-2026-73054

medium2026-10-23

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

siyuan-note/siyuan · GHSA-4pjg-x8qj-33j5 · CVE-2026-73630

medium2026-10-23

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

siyuan-note/siyuan · GHSA-p4qw-vx5p-g984 · CVE-2026-73049

medium2026-10-23

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

siyuan-note/siyuan · GHSA-xp3q-r38w-vgqm

critical2026-10-23

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

the-40-thieves/obsidian-tc · GHSA-pqh8-4pj7-32xx · CVE-2026-77363

medium2026-10-23

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

the-40-thieves/obsidian-tc · GHSA-43r2-c7g8-prc8 · CVE-2026-77362

high2026-10-23

obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

the-40-thieves/obsidian-tc · GHSA-737x-cwfr-5vvc · CVE-2026-115477

critical2026-10-23

obsidian-tc tokens can access arbitrary configured vaults

the-40-thieves/obsidian-tc · GHSA-84c9-qqpq-2pq5 · CVE-2026-77366