Security advisories

medium2026-04-08

Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)

nodemailer/nodemailer · GHSA-vvjj-xcjg-gr5g

medium2026-04-08

kubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution

platform-mesh/kubernetes-graphql-gateway · GHSA-h9mw-h4qc-f5jf

medium2026-04-08

CVE-2026-39859-LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read

harttle/liquidjs · GHSA-v273-448j-v4qj

medium2026-04-08

CVE-2026-39412-LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel

harttle/liquidjs · GHSA-rv5g-f82m-qrvv

medium2026-04-08

CVE-2026-39411-LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header

lobehub/lobehub · GHSA-5mwj-v5jw-5c97

high2026-04-08

CVE-2026-39429-kcp's cache server is accessible without authentication or authorization checks

kcp-dev/kcp · GHSA-3j3q-wp9x-585p

medium2026-04-08

CVE-2026-39844-NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows

zauberzeug/nicegui · GHSA-w8wv-vfpc-hw2w

critical2026-04-08

CVE-2026-39846-SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

siyuan-note/siyuan · GHSA-phhp-9rm9-6gr2

high2026-04-08

CVE-2026-35525-LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates

harttle/liquidjs · GHSA-56p5-8mhr-2fph

low2026-04-08

CVE-2026-34166-LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter

harttle/liquidjs · GHSA-mmg9-6m6j-jqqx

medium2026-04-08

CVE-2026-33753-rfc3161-client Has Improper Certificate Validation

trailofbits/rfc3161-client · GHSA-3xxc-pwj6-jgrj

high2026-04-08

CVE-2026-33229-XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API

xwiki/xwiki-platform · GHSA-h259-74h5-4rh9

medium2026-04-08

CVE-2026-1163-parisneo/lollms has an insufficient session expiration vulnerability

parisneo/lollms · GHSA-8jg2-726g-xh43

medium2026-04-08

Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

aws/aws-sdk-go-v2 · GHSA-xmrv-pmrh-hhx2

high2026-04-08

CVE-2026-39847-Emmett has a path traversal in internal assets handler

emmett-framework/emmett · GHSA-pr46-2v3c-5356

medium2026-04-08

CVE-2026-40071-pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions

pyload/pyload · GHSA-rfgh-63mg-8pwm

medium2026-04-08

CVE-2026-39413-lightrag-hku: JWT Algorithm Confusion Vulnerability

hkuds/lightrag · GHSA-8ffj-4hx4-9pgf

medium2026-04-08

CVE-2026-39410-Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()

honojs/hono · GHSA-r5rp-j6wh-rvv4

medium2026-04-08

CVE-2026-39409-Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

honojs/hono · GHSA-xpcf-pg52-r92g

medium2026-04-08

CVE-2026-56762-Hono missing validation of cookie name on write path in setCookie()

honojs/hono · GHSA-26pp-8wgv-hjvm