Security advisories

medium2026-10-05

CVE-2026-88023-MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

View chart →

mongodb/mongo-php-library · GHSA-8fxw-fmj8-xp7j

critical2026-10-05

CVE-2026-100721-vm2: NodeVM custom resolution bypasses external path boundaries

View chart →

patriksimek/vm2 · GHSA-5h3f-q97h-ccvc

high2026-10-05

CVE-2026-100722-vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

View chart →

patriksimek/vm2 · GHSA-2v2p-6j97-cjg9

medium2026-10-05

CVE-2026-100723-vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

View chart →

patriksimek/vm2 · GHSA-489w-w794-jq94

high2026-10-05

CVE-2026-103921-GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

View chart →

ardatan/graphql-tools · GHSA-6fw5-9hq8-w87g

high2026-10-05

CVE-2026-104852-GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

View chart →

ardatan/graphql-tools · GHSA-7mx3-vvmw-hjmv

medium2026-10-05

CVE-2026-86597-Snowflake drivers writes sensitive information to logs

View chart →

snowflakedb/snowflake-connector-nodejs · GHSA-qqj6-54q6-cxv6

medium2026-10-05

hickory-resolver follows irrelevant CNAME records

View chart →

hickory-dns/hickory-dns · GHSA-6f2x-v7q7-m7m5

high2026-10-05

hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)

View chart →

hickory-dns/hickory-dns · GHSA-6w6g-hm98-mhgm

high2026-10-05

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

View chart →

hickory-dns/hickory-dns · GHSA-5j98-2g5x-46v6

medium2026-10-05

CVE-2026-104844-PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

View chart →

postcss/postcss-selector-parser · GHSA-rj75-hqrm-r3gf

medium2026-10-05

CVE-2026-104871-Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

View chart →

angular/angular-cli · GHSA-7g7c-h8rr-7p6q

high2026-10-05

CVE-2026-104851-fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

View chart →

fsspec/filesystem_spec · GHSA-27vj-qcqg-25rc

critical2026-10-05

CVE-2026-103922-Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

View chart →

ionic-team/capacitor · GHSA-rvm3-566m-v7fv

medium2026-10-05

CVE-2026-104872-Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

View chart →

open-telemetry/opentelemetry-js-contrib · GHSA-qqmp-wf37-98f9

medium2026-10-05

fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values

View chart →

planttheidea/fast-copy · GHSA-jggr-w7fw-pc2j

high2026-10-05

@vue/server-renderer: XSS via missing CR in attribute-name blacklist

View chart →

vuejs/core · GHSA-g2v6-rqmx-r4w6

critical2026-10-05

CVE-2026-104848-Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

View chart →

tinylibs/tinypool · GHSA-5gmw-xhrv-c9v3

critical2026-10-05

CVE-2026-104849-Tinypool: Prototype Pollution Gadget to RCE in run() options

View chart →

tinylibs/tinypool · GHSA-85c8-ppgw-ccpr

high2026-10-05

Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__

View chart →

pallets/quart · GHSA-v853-p72q-4cfw