Security advisories

medium2026-04-01

CVE-2026-34732-AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints

wwbn/avideo · GHSA-g2mg-cgr6-vmv7

high2026-04-01

CVE-2026-34731-AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php

wwbn/avideo · GHSA-4jcg-jxpf-5vq3

medium2026-04-01

NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner

netbirdio/netbird · GHSA-rxmp-8h9v-56cx

high2026-04-01

CVE-2026-34581-goshs has Auth Bypass via Share Token

patrickhener/goshs · GHSA-jgfx-74g2-9r6g

medium2026-04-01

CVE-2026-34716-AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification

wwbn/avideo · GHSA-w4hp-w536-jg64

medium2026-04-01

CVE-2026-34613-AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins

wwbn/avideo · GHSA-hqxf-mhfw-rc44

medium2026-04-01

poetry-plugin-tweak-dependencies-version affected by CVE-2026-25645

sbrunner/poetry-plugin-tweak-dependencies-version · GHSA-5qvp-pr9f-2g2v

medium2026-04-01

CVE-2026-34611-AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users

wwbn/avideo · GHSA-c4xj-x7p8-3x7q

medium2026-04-01

c2cciutils affected by CVE-2022-40896

camptocamp/c2cciutils · GHSA-qc22-xmq4-qg46

high2026-04-01

CVE-2026-34236-Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption

auth0/auth0-php · GHSA-w3wc-44p4-m4j7

high2026-04-01

CVE-2026-34222-Open WebUI has Broken Access Control in Tool Valves

open-webui/open-webui · GHSA-7429-hxcv-268m

high2026-04-01

CVE-2026-33544-Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

steveiliop56/tinyauth · GHSA-9q5m-jfc4-wc92

high2026-04-01

CVE-2026-29782-OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2

devcode-it/openstamanager · GHSA-whv5-4q2f-q68g

high2026-04-01

CVE-2026-28805-OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter

devcode-it/openstamanager · GHSA-3gw8-3mg3-jmpc

medium2026-04-01

CVE-2026-22815-aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage

aio-libs/aiohttp · GHSA-w2fm-2cpv-w7v5

low2026-04-01

CVE-2026-5199-Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster

temporalio/temporal · GHSA-xpg8-3hhp-p7w8

medium2026-04-01

CVE-2026-2265-Replicator deserializes untrusted user input

inikulin/replicator · GHSA-2gmp-34j9-fqjm

critical2026-04-01

CVE-2026-34751-Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

payloadcms/payload · GHSA-hp5w-3hxx-vmwf

high2026-04-01

CVE-2026-34605-SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG (getDynamicIcon, unauthenticated)

siyuan-note/siyuan · GHSA-73g7-86qr-jrg3

high2026-04-01

CVE-2026-34604-@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions

tinacms/tinacms · GHSA-g9c2-gf25-3x67