Security advisories

medium2026-04-08

CVE-2026-39408-Hono: Path traversal in toSSG() allows writing files outside the output directory

honojs/hono · GHSA-xf4j-xp2r-rqqx

medium2026-04-08

CVE-2026-39407-Hono: Middleware bypass via repeated slashes in serveStatic

honojs/hono · GHSA-wmmm-f939-6g9c

medium2026-04-08

CVE-2026-39406-@hono/node-server: Middleware bypass via repeated slashes in serveStatic

honojs/node-server · GHSA-92pp-h63x-v22m

medium2026-04-08

CVE-2026-39373-JWCrypto: JWE ZIP decompression bomb

latchset/jwcrypto · GHSA-fjrm-76x2-c4q4

medium2026-04-08

CVE-2026-39398-openclaw-claude-bridge: sandbox is not effective - `--allowed-tools ""` does not restrict available tools

seal773/openclaw-claude-bridge · GHSA-7853-gqqm-vcwx

critical2026-04-08

CVE-2026-39397-@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections

delmaredigital/payload-puck · GHSA-65w6-pf7x-5g85

medium2026-04-08

CVE-2026-39360-RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration

rustfs/rustfs · GHSA-mx42-j6wv-px98

medium2026-04-08

CVE-2026-39395-Cosign's verify-blob-attestation reports false positive when payload parsing fails

sigstore/cosign · GHSA-w6c6-c85g-mmv6

critical2026-04-08

CVE-2026-39324-Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

rack/rack-session · GHSA-33qg-7wpp-89cq

high2026-04-08

CVE-2026-39356-Drizzle ORM has SQL injection via improperly escaped SQL identifiers

drizzle-team/drizzle-orm · GHSA-gpj5-g38j-94v9

medium2026-04-08

CVE-2026-39381-Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

parse-community/parse-server · GHSA-g4v2-qx3q-4p64

medium2026-04-08

CVE-2026-35583-Emissary has a Path Traversal via Blacklist Bypass in Configuration API

nationalsecurityagency/emissary · GHSA-hxf2-gm22-7vcm

high2026-04-08

CVE-2026-35581-Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

nationalsecurityagency/emissary · GHSA-6c37-7w4p-jg9v

critical2026-04-08

CVE-2026-35580-Emissary has GitHub Actions Shell Injection via Workflow Inputs

nationalsecurityagency/emissary · GHSA-3g6g-gq4r-xjm9

high2026-04-08

CVE-2026-39376-FastFeedParser has an infinite redirect loop DoS via meta-refresh chain

kagisearch/fastfeedparser · GHSA-4gx2-pc4f-wq37

high2026-04-08

CVE-2026-39371-RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests

redwoodjs/sdk · GHSA-x8rx-789c-2pxq

high2026-04-08

CVE-2026-39370-WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)

wwbn/avideo · GHSA-cmcr-q4jf-p6q9

high2026-04-08

CVE-2026-39369-WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs

wwbn/avideo · GHSA-f4f9-627c-jh33

medium2026-04-08

CVE-2026-39368-WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

wwbn/avideo · GHSA-q4x6-6mm2-crg9

medium2026-04-08

CVE-2026-39367-WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

wwbn/avideo · GHSA-rqp3-gf5h-mrqx