Security advisories

high2026-04-14

CVE-2026-40879-Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)

nestjs/nest · GHSA-hpwf-8g29-85qm

high2026-04-14

CVE-2026-33901-ImageMagick has a heap Buffer Overflow in ImageMagick MVG decoder

imagemagick/imagemagick · GHSA-x9h5-r9v2-vcww

high2026-04-14

CVE-2026-32271-Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget

craftcms/commerce · GHSA-875v-7m49-8x88

high2026-04-14

CVE-2026-32272-Craft Commerce hasVariant/hasProduct Blind SQL Injection

craftcms/commerce · GHSA-r54v-qq87-px5r

high2026-04-14

CVE-2026-33908-ImageMagick has a Stack Overflow in DestroyXMLTree()

imagemagick/imagemagick · GHSA-fwvm-ggf6-2p4x

high2026-04-14

CVE-2026-5795-Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables

jetty/jetty.project · GHSA-r7p8-xq5m-436c

high2026-04-14

CVE-2026-40323-SP1 V6 Recursion Circuit Row-Count Binding Gap

succinctlabs/sp1 · GHSA-63x8-x938-vx33

high2026-04-14

CVE-2026-40344-MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

minio/minio · GHSA-9c4q-hq6p-c237

high2026-04-14

SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh

aiondadotcom/mcp-ssh · GHSA-p4h8-56qp-hpgv

high2026-04-14

CVE-2026-40481-In monetr, unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation

monetr/monetr · GHSA-v7xq-3wx6-fqc2

critical2026-04-14

CVE-2026-40576-excel-mcp-server has a Path Traversal issue

haris-musa/excel-mcp-server · GHSA-j98m-w3xp-9f56

low2026-04-13

CVE-2026-6216-DbGate has cross site scripting via the SVG Icon String Handler component

dbgate/dbgate · GHSA-j8j5-7r4h-vj2g

medium2026-04-13

CVE-2026-33899-ImageMagick has a heap-Buffer-Overflow write of a single zero byte when parsing xml.

imagemagick/imagemagick · GHSA-cr67-pvmx-2pp2

medium2026-04-13

CVE-2026-40265-Note Mark has Broken Access Control on Asset Download

enchant97/note-mark · GHSA-p5w6-75f9-cc2p

low2026-04-13

CVE-2026-40263-Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

enchant97/note-mark · GHSA-w6m9-39cv-2fwp

high2026-04-13

CVE-2026-40262-Note Mark has Stored XSS via Unrestricted Asset Upload

enchant97/note-mark · GHSA-9pr4-rf97-79qh

high2026-04-13

CVE-2026-40193-Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username

foxcpp/maddy · GHSA-5835-4gvc-32pc

high2026-04-13

CVE-2026-40192-FITS GZIP decompression bomb in Pillow

python-pillow/pillow · GHSA-whj4-6x5x-4v2j

medium2026-04-13

CVE-2026-34238-ImageMagick has an integer overflow in despeckle operation causing a heap buffer overflow on 32-bit builds

imagemagick/imagemagick · GHSA-26qp-ffjh-2x4v

medium2026-04-13

CVE-2026-33900-ImageMagick has a heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds

imagemagick/imagemagick · GHSA-v67w-737x-v2c9