Security advisories

medium2026-04-10

CVE-2026-40190-LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`

langchain-ai/langsmith-sdk · GHSA-fw9q-39r9-c252

critical2026-04-10

CVE-2026-40189-goshs has a file-based ACL authorization bypass in goshs state-changing routes

patrickhener/goshs · GHSA-wvhv-qcqf-f3cx

high2026-04-10

CVE-2026-40188-goshs is Missing Write Protection for Parametric Data Values

patrickhener/goshs · GHSA-2943-crp8-38xx

medium2026-04-10

CVE-2026-40086-Rembg has a Path Traversal via Custom Model Loading

danielgatis/rembg · GHSA-3wqj-33cg-xc48

critical2026-04-10

CVE-2026-40093-nimiq-blockchain is missing a wall-clock upper bound on block timestamps

nimiq/core-rs-albatross · GHSA-49xc-52mp-cc9j

medium2026-04-10

CVE-2026-40178-ajenti.plugin.core has race conditions in 2FA

ajenti/ajenti · GHSA-8647-755q-fw9p

medium2026-04-10

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

xrootd/xrootd · GHSA-vj8v-p5vw-m6v5

medium2026-04-10

Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload

lin-snow/ech0 · GHSA-69hx-63pv-f8f4

medium2026-04-10

Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

lin-snow/ech0 · GHSA-r2x7-427f-rq69

medium2026-04-10

Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure

lin-snow/ech0 · GHSA-w8jj-cwmc-wgq2

medium2026-04-10

Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass

lin-snow/ech0 · GHSA-fwg7-53p4-g33c

medium2026-04-10

Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

lin-snow/ech0 · GHSA-hm2h-wwwh-g49x

critical2026-04-10

CVE-2026-40177-ajenti.plugin.core has password bypass when 2FA is activated

ajenti/ajenti · GHSA-3mcx-6wxm-qr8v

medium2026-04-10

CVE-2026-40175-Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

axios/axios · GHSA-fvcv-3m26-pcqx

low2026-04-10

REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)

redaxo/core · GHSA-xq4j-g85q-wf97

low2026-04-10

REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)

redaxo/core · GHSA-m662-8jrj-cw6v

medium2026-04-10

Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

lin-snow/ech0 · GHSA-cp79-9mwr-wr49

high2026-04-10

Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export

lin-snow/ech0 · GHSA-4h9q-p5j4-xvvh

low2026-04-10

CVE-2026-114110-uv vulnerable to arbitrary file deletion through RECORD entries

astral-sh/uv · GHSA-pjjw-68hj-v9mw

critical2026-04-10

CVE-2026-40289-PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions

mervinpraison/praisonai · GHSA-8x8f-54wf-vv92