Security advisories

low2026-04-01

CVE-2026-34514-AIOHTTP has CRLF injection through multipart part content type header construction

aio-libs/aiohttp · GHSA-2vrm-gr82-f7m5

low2026-04-01

CVE-2026-34513-AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

aio-libs/aiohttp · GHSA-hcc4-c3v8-rx92

high2026-04-01

CVE-2026-34747-Payload has an SQL Injection via Query Handling

payloadcms/payload · GHSA-7xxh-373w-35vg

medium2026-04-01

CVE-2026-34452-Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape

anthropics/anthropic-sdk-python · GHSA-w828-4qhx-vxx3

medium2026-04-01

CVE-2026-34451-Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories

anthropics/anthropic-sdk-typescript · GHSA-5474-4w2j-mq4c

medium2026-04-01

CVE-2026-34450-Claude SDK for Python has Insecure Default File Permissions in Local Filesystem Memory Tool

anthropics/anthropic-sdk-python · GHSA-q5f5-3gjm-7mfm

medium2026-04-01

CVE-2026-34447-ONNX: External Data Symlink Traversal

onnx/onnx · GHSA-p433-9wv8-28xj

medium2026-04-01

CVE-2026-34446-ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load

onnx/onnx · GHSA-cmw6-hcpp-c6jp

medium2026-04-01

openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers

jahlives/openssl_encrypt · GHSA-c65f-x25w-62jv

medium2026-04-01

openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage

jahlives/openssl_encrypt · GHSA-4rh7-jwg9-m28m

medium2026-04-01

openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers

jahlives/openssl_encrypt · GHSA-2vhw-q7vh-7xv2

medium2026-04-01

openssl-encrypt has no owner verification on key revocation — any client can revoke any key

jahlives/openssl_encrypt · GHSA-hvc7-763r-4f3h

medium2026-04-01

openssl-encrypt's unverified key bundle from_dict() + to_identity() path allows encryption to attacker keys

jahlives/openssl_encrypt · GHSA-8h88-gxp3-j7pg

high2026-04-01

CVE-2026-34445-ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.

onnx/onnx · GHSA-538c-55jv-c5g9

high2026-04-01

CVE-2026-34742-DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost

modelcontextprotocol/go-sdk · GHSA-xw59-hvm2-8pj6

medium2026-04-01

CVE-2026-34740-AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation

wwbn/avideo · GHSA-x5vx-vrpf-r45f

medium2026-04-01

CVE-2026-34739-AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php

wwbn/avideo · GHSA-jqrj-chh6-8h78

medium2026-04-01

CVE-2026-34738-AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

wwbn/avideo · GHSA-m577-w9j8-ch7j

medium2026-04-01

CVE-2026-34737-AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug

wwbn/avideo · GHSA-38rh-4v39-vfxv

medium2026-04-01

CVE-2026-34733-AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

wwbn/avideo · GHSA-wwpw-hrx8-79r5