Security advisories

high2026-04-04

CVE-2026-34511-OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

openclaw/openclaw · GHSA-9jpj-g8vv-j5mf

high2026-04-04

CVE-2026-35454-Code Extension Marketplace: Zip Slip Path Traversal

coder/code-marketplace · GHSA-8x9r-hvwg-c55h

high2026-04-04

CVE-2026-35209-defu: Prototype pollution via `__proto__` key in defaults argument

unjs/defu · GHSA-737v-mqg7-c878

medium2026-04-04

CVE-2026-35452-AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

wwbn/avideo · GHSA-99j6-hj87-6fcf

medium2026-04-04

CVE-2026-35450-AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

wwbn/avideo · GHSA-2vg4-rrx4-qcpq

medium2026-04-04

CVE-2026-35449-AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php

wwbn/avideo · GHSA-hg8q-8wqr-35xx

low2026-04-04

CVE-2026-35448-AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php

wwbn/avideo · GHSA-3v7m-qg4x-58h9

high2026-04-04

CVE-2026-30762-LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass

hkuds/lightrag · GHSA-mcww-4hxq-hfr3

high2026-04-04

CVE-2026-35442-Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries

directus/directus · GHSA-38hg-ww64-rrwc

high2026-04-04

Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver

directus/directus · GHSA-6q22-g298-grjh

medium2026-04-04

CVE-2026-35441-Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits

directus/directus · GHSA-ph52-67fq-75wj

medium2026-04-04

CVE-2026-39943-Directus: Sensitive fields exposed in revision history

directus/directus · GHSA-mvv8-v4jj-g47j

high2026-04-04

CVE-2026-35412-Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite

directus/directus · GHSA-qqmv-5p3g-px89

high2026-04-04

CVE-2026-35409-Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import

directus/directus · GHSA-wv3h-5fx7-966h

medium2026-04-04

CVE-2026-35413-Directus: GraphQL Schema SDL Disclosure Setting

directus/directus · GHSA-wxwm-3fxv-mrvx

medium2026-04-04

CVE-2026-35410-Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow

directus/directus · GHSA-cf45-hxwj-4cfj

medium2026-04-04

CVE-2026-35411-Directus: Open Redirect in Admin 2FA Setup Page

directus/directus · GHSA-q75c-4gmv-mg9x

high2026-04-04

CVE-2026-39942-Directus: Path Traversal and Broken Access Control in File Management API

directus/directus · GHSA-393c-p46r-7c95

high2026-04-04

CVE-2026-35408-Directus: Missing Cross-Origin Opener Policy

directus/directus · GHSA-8m32-p958-jg99

critical2026-04-04

CVE-2026-35216-Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

budibase/budibase · GHSA-fcm4-4pj2-m5hf