Security advisories

high2026-04-04

CVE-2026-35214-Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

budibase/budibase · GHSA-2wfh-rcwf-wh23

medium2026-04-04

actions-mkdocs: Command Injection via issue title in internal GitHub Actions workflow

tiryoh/actions-mkdocs · GHSA-6p2j-742g-835f

medium2026-04-04

DynFuture Drop Can Construct a Dangling Reference

xacrimon/dyn-future · GHSA-j3w3-p6mr-3hrh

high2026-04-04

scaly: Multiple soundness issues in Rust safe APIs

rschleitzer/scaly · GHSA-2c6h-4899-wjxr

high2026-04-04

CVE-2026-35394-@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url

mobile-next/mobile-mcp · GHSA-5qhv-x9j4-c3vm

high2026-04-04

@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags

stablelib/stablelib · GHSA-5jg4-p4qw-cgfr

high2026-04-04

@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding

stablelib/stablelib · GHSA-w48f-fwg7-ww6p

high2026-04-04

CVE-2026-35213-@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing

hapijs/content · GHSA-jg4p-7fhp-p32p

low2026-04-04

CVE-2026-35200-Parse Server: File upload Content-Type override via extension mismatch

parse-community/parse-server · GHSA-vr5f-2r24-w5hc

high2026-04-04

CVE-2026-35187-pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter

pyload/pyload · GHSA-2wvg-62qm-gj33

high2026-04-04

Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers

fasterxml/jackson-core · GHSA-2m67-wjpj-xhg9

medium2026-04-03

CVE-2026-35181-AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php

wwbn/avideo · GHSA-4q27-4rrq-fx95

medium2026-04-03

CVE-2026-35166-Hugo: Certain markdown links are not properly escaped

gohugoio/hugo · GHSA-mcv8-8m8x-48pg

medium2026-04-03

CVE-2026-35179-AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

wwbn/avideo · GHSA-x9w5-xccw-5h9w

high2026-04-03

CVE-2026-35044-BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile Generation

bentoml/bentoml · GHSA-v959-cwq9-7hr6

high2026-04-03

CVE-2026-35043-BentoML: Command Injection in cloud deployment setup script

bentoml/bentoml · GHSA-fgv4-6jr3-jgfw

high2026-04-03

CVE-2026-35042-fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)

nearform/fast-jwt · GHSA-hm7r-c7qw-ghp6

critical2026-04-03

CVE-2026-35030-LiteLLM: Authentication bypass via OIDC userinfo cache key collision

berriai/litellm · GHSA-jjhc-v7c2-5hh6

high2026-04-03

CVE-2026-35029-LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

berriai/litellm · GHSA-53mr-6c8q-9789

critical2026-04-03

CVE-2026-35471-goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

patrickhener/goshs · GHSA-6qcc-6q27-whp8