Security advisories

low2026-04-01

CVE-2026-34762-Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber

ellanetworks/core · GHSA-xw45-cc32-442f

medium2026-04-01

CVE-2026-34761-Ella Core Panics Upon NGAP handover failure

ellanetworks/core · GHSA-6gm8-3g4h-w82m

high2026-04-01

CVE-2026-34752-Haraka affected by DoS via `__proto__` email header

haraka/haraka · GHSA-xph3-r2jf-4vp3

medium2026-04-01

CVE-2026-34730-Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode

copier-org/copier · GHSA-hgjq-p8cr-gg4h

medium2026-04-01

CVE-2026-34729-phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()

thorsten/phpmyfaq · GHSA-cv2g-8cj8-vgc7

high2026-04-01

CVE-2026-34728-phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController

thorsten/phpmyfaq · GHSA-38m8-xrfj-v38x

medium2026-04-01

CVE-2026-34726-Copier `_subdirectory` allows template root escape via parent-directory traversal

copier-org/copier · GHSA-85v3-4m8g-hrh6

high2026-04-01

CVE-2026-34725-dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration

dbgate/dbgate · GHSA-35xm-qvjg-8m42

medium2026-04-01

CVE-2026-34715-ewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting)

vshakitskiy/ewe · GHSA-x2w3-23jr-hrpf

high2026-04-01

CVE-2026-34591-Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write

python-poetry/poetry · GHSA-2599-h6xx-hpxp

medium2026-04-01

StableLib Ed25519 Signature Malleability via Missing S < L Check

stablelib/stablelib · GHSA-x3ff-w252-2g7j

high2026-04-01

CVE-2026-34572-CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

ci4-cms-erp/ci4ms · GHSA-8fq3-c5w3-pj3q

critical2026-04-01

CVE-2026-34571-CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise

ci4-cms-erp/ci4ms · GHSA-fc4p-p49v-r948

high2026-04-01

CVE-2026-34570-CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

ci4-cms-erp/ci4ms · GHSA-4vxv-4xq4-p84h

critical2026-04-01

CVE-2026-34569-CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-fhrf-q333-82fm

critical2026-04-01

CVE-2026-34568-CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-x7wh-g25g-53vg

critical2026-04-01

CVE-2026-34567-CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-r33w-c82v-x5v7

critical2026-04-01

CVE-2026-34566-CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-458r-h248-29c5

critical2026-04-01

CVE-2026-34565-CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-xgh5-w62m-8mpr

critical2026-04-01

CVE-2026-34564-CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-g4pp-fhgf-8653