Security advisories

high2026-03-31

CVE-2026-34573-parse-server has GraphQL complexity validator exponential fragment traversal DoS

parse-community/parse-server · GHSA-mfj6-6p54-m98c

critical2026-03-31

CVE-2026-34532-parse-server has cloud function validator bypass via prototype chain traversal

parse-community/parse-server · GHSA-vpj2-qq7w-5qq6

medium2026-03-31

CVE-2026-34531-Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

miguelgrinberg/flask-httpauth · GHSA-p44q-vqpr-4xmg

medium2026-03-31

CVE-2026-34530-File Browser vulnerable to Stored Cross-site Scripting via text/template branding injection

filebrowser/filebrowser · GHSA-xfqj-3vmx-63wv

high2026-03-31

CVE-2026-34528-File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution

filebrowser/filebrowser · GHSA-x8jc-jvqm-pm3f

high2026-03-31

CVE-2026-34529-File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file

filebrowser/filebrowser · GHSA-5vpr-4fgw-f69h

medium2026-03-31

openssl-encrypt silently skips schema validation when jsonschema library is not installed

jahlives/openssl_encrypt · GHSA-425g-fjhq-5h92

medium2026-03-31

openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection

jahlives/openssl_encrypt · GHSA-vfgx-5q85-58q3

medium2026-03-31

openssl-encrypt has visible password in process list via --password CLI argument

jahlives/openssl_encrypt · GHSA-h3m5-p59h-x88p

critical2026-03-31

openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart

jahlives/openssl_encrypt · GHSA-h45m-mgcp-q388

medium2026-03-31

openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification

jahlives/openssl_encrypt · GHSA-j48q-4c78-rhf9

high2026-03-31

CVE-2026-34453-SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark

siyuan-note/siyuan · GHSA-c77m-r996-jr3q

critical2026-03-31

CVE-2026-34449-SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

siyuan-note/siyuan · GHSA-68p4-j234-43mv

critical2026-03-31

CVE-2026-34448-SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client

siyuan-note/siyuan · GHSA-rx4h-526q-4458

medium2026-03-31

CVE-2026-34405-Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes

nuxt-modules/og-image · GHSA-mg36-wvcr-m75h

medium2026-03-31

Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters

nuxt-modules/og-image · GHSA-pqhr-mp3f-hrpp

medium2026-03-31

CVE-2026-34404-Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions

nuxt-modules/og-image · GHSA-c7xp-q6q8-hg76

medium2026-03-31

CVE-2026-34400-alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

alerta/alerta · GHSA-8prr-286p-4w7j

medium2026-03-31

CVE-2026-34396-AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel

wwbn/avideo · GHSA-v4h7-3x43-qqw4

medium2026-03-31

CVE-2026-34395-AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

wwbn/avideo · GHSA-77jp-mgcw-rfmr