Security advisories

high2026-04-10

CVE-2026-41139-mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes

josdejong/mathjs · GHSA-jvff-x2qm-6286

low2026-04-10

unhead: Streaming SSR `streamKey` injected into inline script without identifier validation

unjs/unhead · GHSA-x7mm-9vvv-64w8

medium2026-04-10

rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak default CORS configuration

danielgatis/rembg · GHSA-55v6-g8pm-pw4c

medium2026-04-10

CVE-2026-5724-Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint

temporalio/temporal · GHSA-q98v-9f9w-f49q

critical2026-04-10

CVE-2026-41679-paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

paperclipai/paperclip · GHSA-68qg-g8mg-6pr7

medium2026-04-10

CVE-2026-40301-rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives

rhukster/dom-sanitizer · GHSA-93vf-569f-22cq

medium2026-04-10

CVE-2026-40306-DNN: Same HostGUID for all new installs

dnnsoftware/dnn.platform · GHSA-2rhw-gw3f-477j

medium2026-04-10

CVE-2026-40305-DNN: Force Friend Request Acceptance

dnnsoftware/dnn.platform · GHSA-fpj4-9qhx-5m6m

medium2026-04-10

CVE-2026-40299-next-intl has an open redirect vulnerability

amannn/next-intl · GHSA-8f24-v5vv-gm5j

medium2026-04-10

CVE-2026-5774-Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence

juju/juju · GHSA-7m55-2hr4-pw78

critical2026-04-10

CVE-2026-5412-Juju: CloudSpec method leaking cloud credentials

juju/juju · GHSA-w5fq-8965-c969

critical2026-04-10

CVE-2026-40258-gramps-webapi: Zip Slip Path Traversal in Media Archive Import

gramps-project/gramps-web-api · GHSA-m5gr-86j6-99jp

high2026-04-10

n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport

czlonkowski/n8n-mcp · GHSA-75hx-xj24-mqrw

medium2026-04-10

CVE-2026-40260-pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

py-pdf/pypdf · GHSA-3crg-w4f6-42mx

high2026-04-10

CVE-2026-40242-Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint

getarcaneapp/arcane · GHSA-ff24-4prj-gpmj

low2026-04-10

CVE-2026-40194-phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()

phpseclib/phpseclib · GHSA-r854-jrxh-36qx

high2026-04-10

CVE-2026-40321-DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

dnnsoftware/dnn.platform · GHSA-ffq7-898w-9jc4

high2026-04-10

basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands

patrickjuchli/basic-ftp · GHSA-6v7q-wjvx-w8wg

low2026-04-10

CVE-2026-40109-Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

fluxcd/notification-controller · GHSA-h9cx-xjg6-5v2w

low2026-04-10

CVE-2026-40097-Step CA affected by an index out of bounds panic in TPM attestation EKU validation

smallstep/certificates · GHSA-9qq8-cgcv-qmc9