Security advisories

critical2026-04-01

CVE-2026-34563-CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS

ci4-cms-erp/ci4ms · GHSA-85m8-g393-jcxf

medium2026-04-01

CVE-2026-34562-CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-v897-c6vq-6cr3

critical2026-04-01

CVE-2026-34561-CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-gcfj-cf7j-vwgj

critical2026-04-01

CVE-2026-34560-CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-r4v5-rwr2-q7r4

critical2026-04-01

CVE-2026-34559-CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-4333-387x-w245

medium2026-04-01

CVE-2026-34525-AIOHTTP accepts duplicate Host headers

aio-libs/aiohttp · GHSA-c427-h43c-vf67

low2026-04-01

CVE-2026-34520-AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

aio-libs/aiohttp · GHSA-63hf-3vf5-4wqf

low2026-04-01

CVE-2026-34519-AIOHTTP has HTTP response splitting via \r in reason phrase

aio-libs/aiohttp · GHSA-mwh4-6h8g-pg8w

low2026-04-01

CVE-2026-34518-AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

aio-libs/aiohttp · GHSA-966j-vmvw-g2g9

low2026-04-01

CVE-2026-34517-AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

aio-libs/aiohttp · GHSA-3wq7-rqq7-wx6j

medium2026-04-01

CVE-2026-34750-Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints

payloadcms/payload · GHSA-frq9-7j6g-v74x

medium2026-04-01

CVE-2026-34516-AIOHTTP has a Multipart Header Size Bypass

aio-libs/aiohttp · GHSA-m5qp-6w8w-w647

medium2026-04-01

CVE-2026-34526-SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6

sillytavern/sillytavern · GHSA-wm7j-m6jm-8797

high2026-04-01

CVE-2026-34524-SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root

sillytavern/sillytavern · GHSA-vprr-q85p-79mf

medium2026-04-01

CVE-2026-34523-SillyTavern: Path Traversal allows file existence oracle

sillytavern/sillytavern · GHSA-525j-2hrj-m8fp

high2026-04-01

CVE-2026-34522-SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory

sillytavern/sillytavern · GHSA-xvww-xhx6-22pf

medium2026-04-01

CVE-2026-34749-Payload has a CSRF Protection Bypass in Authentication Flow

payloadcms/payload · GHSA-p6mr-xf3r-ghq4

medium2026-04-01

CVE-2026-34515-AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

aio-libs/aiohttp · GHSA-p998-jp59-783m

high2026-04-01

CVE-2026-34746-Payload has Authenticated SSRF via Upload Functionality

payloadcms/payload · GHSA-6r7f-q7f5-wpx8

high2026-04-01

CVE-2026-34748-@payloadcms/next has Stored XSS in Admin Panel

payloadcms/payload · GHSA-mmxc-95ch-2j7c