Security advisories

high2026-04-14

CVE-2026-40943-Oxia affected by server crash via race condition in session heartbeat handling

oxia-db/oxia · GHSA-5gqc-qhrj-9xw8

critical2026-04-14

CVE-2026-40946-Oxia has an OIDC token audience validation bypass via SkipClientIDCheck

oxia-db/oxia · GHSA-fhvp-9hcj-6m33

high2026-04-14

CVE-2026-40945-Oxia exposes bearer token in debug log messages on authentication failure

oxia-db/oxia · GHSA-pm7q-rjjx-979p

medium2026-04-14

CVE-2026-40320-Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck

giskard-ai/giskard-oss · GHSA-7xjm-g8f4-rp26

low2026-04-14

CVE-2026-40319-Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check

giskard-ai/giskard-oss · GHSA-rq2q-4r55-9877

medium2026-04-14

CVE-2026-40935-CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure

wwbn/avideo · GHSA-hg7g-56h5-5pqr

medium2026-04-14

CVE-2026-40929-WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators

wwbn/avideo · GHSA-8qm8-g55h-xmqr

medium2026-04-14

CVE-2026-40928-WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion

wwbn/avideo · GHSA-x2pw-9c38-cp2j

high2026-04-14

CVE-2026-40926-WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)

wwbn/avideo · GHSA-ffw8-fwxp-h64w

high2026-04-14

CVE-2026-40925-WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

wwbn/avideo · GHSA-vvfw-4m39-fjqf

medium2026-04-14

CVE-2026-40922-SiYuan has incomplete fix for CVE-2026-33066: XSS

siyuan-note/siyuan · GHSA-8q5w-mmxf-48jg

low2026-04-14

Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint

patrickhener/goshs · GHSA-7qx6-f23w-3w7f

critical2026-04-14

CVE-2026-40911-WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

wwbn/avideo · GHSA-gph2-j4c9-vhhr

high2026-04-14

CVE-2026-40909-WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)

wwbn/avideo · GHSA-6rc6-p838-686f

medium2026-04-14

CVE-2026-40908-WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version

wwbn/avideo · GHSA-52hf-63q4-r926

medium2026-04-14

CVE-2026-40907-WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens

wwbn/avideo · GHSA-gpgp-w4x2-h3h7

high2026-04-14

CVE-2026-40890-Go Markdown has an Out-of-bounds Read in SmartypantsRenderer

gomarkdown/markdown · GHSA-77fj-vx54-gvh7

critical2026-04-14

CVE-2026-40887-@vendure/core has a SQL Injection vulnerability

vendurehq/vendure · GHSA-9pp3-53p2-ww9v

high2026-04-14

CVE-2026-4789-Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access

kyverno/kyverno · GHSA-rggm-jjmc-3394

medium2026-04-14

CVE-2026-40104-XWiki's REST APIs can list all pages/spaces, leading to unavailability

xwiki/xwiki-platform · GHSA-mrqg-xmgm-rc5g