Security advisories

high2026-04-03

CVE-2026-35470-OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals

devcode-it/openstamanager · GHSA-mmm5-3g4x-qw39

high2026-04-03

CVE-2026-34824-Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service

mesop-dev/mesop · GHSA-3jr7-6hqp-x679

high2026-04-03

CVE-2026-25044-Budibase: Command Injection in Bash Automation Step

budibase/budibase · GHSA-gjw9-34gf-rp6m

low2026-04-03

CVE-2026-34764-Electron: Use-after-free in offscreen shared texture release() callback

electron/electron · GHSA-8x5q-pvf5-64mp

medium2026-04-03

CVE-2026-34755-vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

vllm-project/vllm · GHSA-pq5c-rjhq-qp7p

medium2026-04-03

CVE-2026-34753-vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

vllm-project/vllm · GHSA-pf3h-qjgv-vcpr

high2026-04-03

CVE-2026-34543-OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)

academysoftwarefoundation/openexr · GHSA-vc68-257w-m432

high2026-04-03

CVE-2026-34544-OpenEXR: integer overflow to OOB write in uncompress_b44_impl()

academysoftwarefoundation/openexr · GHSA-h762-rhv3-h25v

medium2026-04-03

CVE-2026-34217-SandboxJS: Sandbox Escape via Prop Object Leak in New Handler

nyariv/sandboxjs · GHSA-hg73-4w7g-q96w

medium2026-04-03

CVE-2026-34211-SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser

nyariv/sandboxjs · GHSA-8pfc-jjgw-6g26

critical2026-04-03

CVE-2026-34208-SandboxJS: Sandbox integrity escape

nyariv/sandboxjs · GHSA-2gg9-6p7w-6cpj

medium2026-04-03

CVE-2026-34083-Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow

signalk/signalk-server · GHSA-cxj8-ggf2-p57c

medium2026-04-03

CVE-2026-34052-LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)

jupyterhub/ltiauthenticator · GHSA-8mxq-7xr7-2fxj

medium2026-04-03

CVE-2026-33951-Signal K Server: Unauthenticated Source Priorities Manipulation

signalk/signalk-server · GHSA-gfmv-vh34-h2x5

critical2026-04-03

CVE-2026-33950-Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity

signalk/signalk-server · GHSA-x8hc-fqv3-7gwf

high2026-04-03

CVE-2026-33752-curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)

lexiforest/curl_cffi · GHSA-qw2m-4pqf-rmpp

medium2026-04-03

CVE-2026-33709-JupyterHub has an Open Redirect Vulnerability

jupyterhub/jupyterhub · GHSA-3vff-hjqv-m7h8

high2026-04-03

CVE-2026-33175-Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims

jupyterhub/oauthenticator · GHSA-rrvg-cxh4-qhrv

critical2026-04-03

CVE-2026-31818-Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

budibase/budibase · GHSA-7r9j-r86q-7g45

medium2026-04-03

CVE-2026-30867-CocoaMQTT: Denial of Service via Reachable Assertion in `PUBLISH` Packet Parsing

emqx/cocoamqtt · GHSA-r3fr-7m74-q7g2