Security advisories

medium2026-04-01

YesWiki has Multiple Reflected Cross-site Scripting Vulnerabilities

yeswiki/yeswiki · GHSA-5724-x3rh-5qqq

high2026-04-01

CVE-2026-34603-@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions

tinacms/tinacms · GHSA-g87c-r2jp-293w

high2026-04-01

CVE-2026-34601-xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

xmldom/xmldom · GHSA-wh4c-j3r5-mjhp

high2026-04-01

CVE-2026-34593-Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash

ash-project/ash · GHSA-jjf9-w5vj-r6vp

high2026-04-01

CVE-2026-34598-YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter"

yeswiki/yeswiki · GHSA-37fq-47qj-6j5j

critical2026-04-01

CVE-2026-34557-CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-rpjr-985c-qhvm

critical2026-04-01

CVE-2026-34558-CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-v77r-xg3p-75g7

medium2026-04-01

CVE-2026-34595-Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value

parse-community/parse-server · GHSA-mmg8-87c5-jrc2

high2026-04-01

CVE-2026-34585-SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution

siyuan-note/siyuan · GHSA-ff66-236v-p4fg

high2026-04-01

CVE-2024-49048-TorchGeo Remote Code Execution Vulnerability

torchgeo/torchgeo · GHSA-ghq9-vc6f-8qjf

medium2026-04-01

CVE-2026-34574-Parse Server has a session field immutability bypass via falsy-value guard

parse-community/parse-server · GHSA-f6j3-w9v3-cq22

critical2026-04-01

CVE-2026-41294-OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

openclaw/openclaw · GHSA-8rh7-6779-cjqq

high2026-04-01

CVE-2026-41380-OpenClaw gateway exec allow-always over-trusts positional carrier executables

openclaw/openclaw · GHSA-p4x4-2r7f-wjxg

low2026-04-01

CVE-2026-34504-OpenClaw affected by SSRF via unguarded image download in fal provider

openclaw/openclaw · GHSA-qxgf-hmcj-3xw3

medium2026-04-01

CVE-2026-33578-OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade

openclaw/openclaw · GHSA-63mg-xp9j-jfcm

high2026-04-01

OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`

openclaw/openclaw · GHSA-5r8f-96gm-5j6g

medium2026-04-01

CVE-2026-33577-OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

openclaw/openclaw · GHSA-2x4x-cc5g-qmmg

high2026-03-31

CVE-2026-41390-OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper

openclaw/openclaw · GHSA-6pfc-6m7w-m8fx

high2026-03-31

CVE-2026-41387-OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

openclaw/openclaw · GHSA-j7p2-qcwm-94v4

medium2026-03-31

CVE-2026-33580-OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication

openclaw/openclaw · GHSA-9528-x887-j2fp