Security advisories

high2026-04-02

CVE-2026-34827-Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters

rack/rack · GHSA-v6x5-cg8r-vv6x

medium2026-04-02

CVE-2026-34826-Rack's multipart byte range processing allows denial of service via excessive overlapping ranges

rack/rack · GHSA-x8cg-fq8g-mxfx

medium2026-04-02

CVE-2026-34786-Rack:: Static header_rules bypass via URL-encoded paths

rack/rack · GHSA-q4qf-9j86-f5mh

high2026-04-02

CVE-2026-34785-Rack::Static prefix matching can expose unintended files under the static root

rack/rack · GHSA-h2jq-g4cq-5ppq

critical2026-04-02

Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions

lightdash/lightdash · GHSA-3hfp-gqgh-xc5g

critical2026-04-02

CVE-2026-34841-Axios npm Supply Chain Incident Impacting @usebruno/cli

usebruno/bruno · GHSA-658g-p7jg-wx5g

low2026-04-02

CVE-2026-5370-Krayin CRM is vulnerable to Cross-site Scripting (XSS)

krayin/laravel-crm · GHSA-9m2v-hc5g-5jpv

medium2026-04-02

CVE-2026-4325-Keycloak: Replay of action tokens via improper handling of single-use entries

keycloak/keycloak · GHSA-rx66-hj7g-28h7

high2026-04-02

CVE-2026-4282-Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw

keycloak/keycloak · GHSA-hj93-h7pg-fh6v

high2026-04-02

CVE-2026-4634-Keycloak: Application-Level DoS via Scope Processing

keycloak/keycloak · GHSA-h4wv-g838-66g3

high2026-04-02

CVE-2026-4636-Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants

keycloak/keycloak · GHSA-f2hx-5fx3-hmcv

high2026-04-02

CVE-2026-3872-Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint

keycloak/keycloak · GHSA-cjm2-j6cm-6p6m

low2026-04-02

CVE-2026-5327-fast-filesystem-mcp is vulnerable to command injection through handleGetDiskUsage function

efforthye/fast-filesystem-mcp · GHSA-5226-3rvg-hp4x

low2026-04-02

CVE-2026-5323-a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer function

priyankark/a11y-mcp · GHSA-prmx-7v35-7q82

critical2026-04-02

CVE-2026-4370-Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster

juju/juju · GHSA-gvrj-cjch-728p

high2026-04-01

mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

vercel/mcp-handler · GHSA-w2fm-25vw-vh7f

high2026-04-01

EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory

alastairlundy/enhancedlinq · GHSA-32wq-ppwg-3w4m

high2026-04-01

CVE-2026-4800-lodash vulnerable to Code Injection via `_.template` imports key names

lodash/lodash · GHSA-r5fr-rjxr-66jc

medium2026-04-01

CVE-2026-2950-lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt

lodash/lodash · GHSA-f23m-r3pf-42rh

high2026-04-01

CVE-2026-34828-listmonk's active sessions remain valid after password reset and password change

knadh/listmonk · GHSA-h5j9-cvrw-v5qh