Security advisories

low2026-04-06

PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state

pmmp/pocketmine-mp · GHSA-f9jp-856v-8642

medium2026-04-06

PocketMine-MP: Network amplification vulnerability with `ActorEventPacket`

pmmp/pocketmine-mp · GHSA-7hmv-4j2j-pp6f

high2026-04-06

PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling

pmmp/pocketmine-mp · GHSA-788v-5pfp-93ff

high2026-04-06

PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket

pmmp/pocketmine-mp · GHSA-h6rj-3m53-887h

medium2026-04-06

CVE-2026-34425-OpenClaw's complex interpreter pipelines could skip exec script preflight validation

openclaw/openclaw · GHSA-fvx6-pj3r-5q4q

medium2026-04-06

CVE-2026-31313-Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module

liufee/cms · GHSA-hj9c-p59c-vqph

medium2026-04-06

CVE-2026-31354-Feehi CMS has authenticated stored cross-site scripting (XSS) vulnerabilities via the Permissions module

liufee/cms · GHSA-xqm9-6qmm-xrqh

medium2026-04-06

CVE-2026-31352-Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Role Management module

liufee/cms · GHSA-hqjc-wfvx-x2fv

medium2026-04-06

CVE-2026-31351-Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module

liufee/cms · GHSA-cvjh-88c8-2jjx

medium2026-04-06

CVE-2026-31350-Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Page Sign parameter

liufee/cms · GHSA-cgxr-v74v-g9mm

medium2026-04-06

CVE-2026-31353-Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Category module

liufee/cms · GHSA-664p-j3q6-p843

medium2026-04-06

CVE-2026-39365-Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

vitejs/vite · GHSA-4w7w-66w2-5vf9

high2026-04-06

CVE-2026-39364-Vite: `server.fs.deny` bypassed with queries

vitejs/vite · GHSA-v2wj-q39q-566r

high2026-04-06

CVE-2026-39363-Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

vitejs/vite · GHSA-p9ff-h696-f583

high2026-04-06

CVE-2026-35526-strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions

strawberry-graphql/strawberry · GHSA-hv3w-m4g2-5x77

high2026-04-06

CVE-2026-35523-strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol

strawberry-graphql/strawberry · GHSA-vpwc-v33q-mq89

critical2026-04-06

CVE-2026-35490-changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering

dgtlmoon/changedetection.io · GHSA-jmrh-xmgh-x9j4

medium2026-04-06

CVE-2026-35515-@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

nestjs/nest · GHSA-36xv-jgw5-4q75

high2026-04-06

Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri

authorizerdev/authorizer · GHSA-x3f4-v83f-7wp2

high2026-04-06

Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation

authorizerdev/authorizer · GHSA-jfwg-rxf3-p7r9