Security advisories

medium2026-03-31

openssl-encrypt has visible password in process list via --password CLI argument

jahlives/openssl_encrypt · GHSA-h3m5-p59h-x88p

critical2026-03-31

openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart

jahlives/openssl_encrypt · GHSA-h45m-mgcp-q388

medium2026-03-31

openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification

jahlives/openssl_encrypt · GHSA-j48q-4c78-rhf9

high2026-03-31

CVE-2026-34453-SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark

siyuan-note/siyuan · GHSA-c77m-r996-jr3q

critical2026-03-31

CVE-2026-34449-SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

siyuan-note/siyuan · GHSA-68p4-j234-43mv

critical2026-03-31

CVE-2026-34448-SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client

siyuan-note/siyuan · GHSA-rx4h-526q-4458

medium2026-03-31

CVE-2026-34405-Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes

nuxt-modules/og-image · GHSA-mg36-wvcr-m75h

medium2026-03-31

Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters

nuxt-modules/og-image · GHSA-pqhr-mp3f-hrpp

medium2026-03-31

CVE-2026-34404-Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions

nuxt-modules/og-image · GHSA-c7xp-q6q8-hg76

medium2026-03-31

CVE-2026-34400-alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

alerta/alerta · GHSA-8prr-286p-4w7j

medium2026-03-31

CVE-2026-34396-AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel

wwbn/avideo · GHSA-v4h7-3x43-qqw4

medium2026-03-31

CVE-2026-34395-AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

wwbn/avideo · GHSA-77jp-mgcw-rfmr

high2026-03-31

CVE-2026-34394-AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking

wwbn/avideo · GHSA-4wwr-7h7c-chqr

low2026-03-31

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

j0k3r/graby · GHSA-3h6j-9x8m-rg3g

medium2026-03-31

CVE-2026-34383-Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter

admidio/admidio · GHSA-4rwm-c5mj-wh7x

medium2026-03-31

CVE-2026-34384-Admidio has Missing CSRF Protection on Registration Approval Actions

admidio/admidio · GHSA-ph84-r98x-2j22

medium2026-03-31

CVE-2026-34382-Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php

admidio/admidio · GHSA-g3mx-8jm6-rc85

high2026-03-31

CVE-2026-34381-Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccess

admidio/admidio · GHSA-7fh7-8xqm-3g88

high2026-03-31

CVE-2026-34240-jose vulnerable to untrusted JWK header key acceptance during signature verification

appsup-dart/jose · GHSA-vm9r-h74p-hg97

medium2026-03-31

CVE-2026-34227-Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface

bishopfox/sliver · GHSA-6fpf-248c-m7wm