Security advisories

medium2026-04-08

CVE-2026-39366-WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

wwbn/avideo · GHSA-mmw7-wq3c-wf9p

medium2026-04-08

kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level

cloudnativelabs/kube-router · GHSA-fcmh-qfxc-w685

medium2026-04-08

skilleton has improper input handling in repository/path processing

fcmam5/skilleton · GHSA-5g3j-89fr-r2vp

medium2026-04-08

CVE-2026-39321-Parse Server has a login timing side-channel reveals user existence

parse-community/parse-server · GHSA-mmpq-5hcv-hf2v

low2026-04-08

justhtml: Mutation XSS with custom foreign-namespace sanitization policies

emilstenstrom/justhtml · GHSA-r758-8hxw-4845

medium2026-04-08

CVE-2026-35613-coursevault-preview has a path traversal due to improper base-directory boundary validation

moritzmyrz/coursevault-preview · GHSA-9h9m-rr67-9jpg

high2026-04-08

CVE-2026-35611-Addressable has a Regular Expression Denial of Service in Addressable templates

sporkmonger/addressable · GHSA-h27x-rffw-24p4

high2026-04-08

CVE-2026-35607-File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands

filebrowser/filebrowser · GHSA-7526-j432-6ppp

medium2026-04-08

CVE-2026-35606-File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check

filebrowser/filebrowser · GHSA-67cg-cpj7-qgc9

high2026-04-08

CVE-2026-35604-File Browser share links remain accessible after Share/Download permissions are revoked

filebrowser/filebrowser · GHSA-v9w4-gm2x-6rvf

medium2026-04-08

CVE-2026-35605-File Browser has an access rule bypass via HasPrefix without trailing separator in path matching

filebrowser/filebrowser · GHSA-5q48-q4fm-g3m6

medium2026-04-08

CVE-2026-35592-pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass

pyload/pyload · GHSA-mvwx-582f-56r7

medium2026-04-08

CVE-2026-35586-pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

pyload/pyload · GHSA-ppvx-rwh9-7rj7

high2026-04-08

CVE-2026-35585-File Browser has a Command Injection via Hook Runner

filebrowser/filebrowser · GHSA-jvpw-637p-h3pw

high2026-04-08

LiteLLM: Password hash exposure and pass-the-hash authentication bypass

berriai/litellm · GHSA-69x8-hrgq-fjj8

medium2026-04-07

CVE-2026-5739-PowerJob's GroovyEvaluator.evaluate endpoint vulnerable to code injection

powerjob/powerjob · GHSA-wpwf-v25w-54g3

medium2026-04-07

CVE-2026-5736-PowerJob vulnerable to SQL injection

powerjob/powerjob · GHSA-4fp2-3xgg-jg4w

high2026-04-07

CVE-2025-56015-GenieACS has an unauthenticated access vulnerability via the NBI API endpoint

genieacs/genieacs · GHSA-2h6j-mhcp-9j9h

high2026-04-07

MONAI: Unsafe functions lead to pickle deserialization rce

project-monai/monai · GHSA-89gg-p5r5-q6r4

medium2026-04-07

CVE-2026-35571-Emissary has Stored XSS via Navigation Template Link Injection

nationalsecurityagency/emissary · GHSA-cpm7-cfpx-3hvp