Security advisories

low2026-03-31

CVE-2026-34203-Nautobot: Management of users via REST API does not apply configured password validators

nautobot/nautobot · GHSA-xmpv-j7p2-j873

critical2026-03-31

CVE-2026-32871-FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

prefecthq/fastmcp · GHSA-vv7q-7jx5-f767

high2026-03-31

CVE-2026-32734-baserCMS is Vulnerable to Cross-site Scripting

baserproject/basercms · GHSA-677c-xv24-crgx

high2026-03-31

CVE-2026-32727-SciTokens has an Authorization Bypass via Path Traversal in Scope Validation

scitokens/scitokens · GHSA-3x2w-63fp-3qvw

high2026-03-31

CVE-2026-32716-SciTokens has an Authorization Bypass via Incorrect Scope Path Prefix Checking

scitokens/scitokens · GHSA-w8fp-g9rh-34jh

critical2026-03-31

CVE-2026-32714-SciTokens is vulnerable to SQL Injection in KeyCache

scitokens/scitokens · GHSA-rh5m-2482-966c

medium2026-03-31

CVE-2026-32629-phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor

thorsten/phpmyfaq · GHSA-98gw-w575-h2ph

high2026-03-31

CVE-2026-30940-baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API

baserproject/basercms · GHSA-c5c6-37vq-pjcq

critical2026-03-31

CVE-2026-30880-baserCMS has OS command injection vulnerability in installer

baserproject/basercms · GHSA-6hpg-8rx3-cwgv

medium2026-03-31

CVE-2026-30879-baserCMS has a cross-site scripting vulnerability in blog posts

baserproject/basercms · GHSA-jmq3-x8q7-j9qm

medium2026-03-31

CVE-2026-30878-baserCMS has Mail Form Acceptance Bypass via Public API

baserproject/basercms · GHSA-8cr7-r8qw-gp3c

critical2026-03-31

CVE-2026-30877-baserCMS Update Functionality Vulnerable to OS Command Injection

baserproject/basercms · GHSA-m9g7-rgfc-jcm7

medium2026-03-31

CVE-2026-27697-baserCMS has an SQL injection vulnerability in its blog post functionality

baserproject/basercms · GHSA-vh89-rjph-2g7p

high2026-03-31

CVE-2026-27489-onnx Vulnerable to Path Traversal via Symlink

onnx/onnx · GHSA-3r9x-f23j-gc73

high2026-03-31

CVE-2026-27124-FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

prefecthq/fastmcp · GHSA-rww4-4w9c-7733

high2026-03-31

CVE-2026-25726-Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)

cloudreve/cloudreve · GHSA-f8xp-wvcx-p6f4

critical2026-03-31

CVE-2026-21861-baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)

baserproject/basercms · GHSA-qxmc-6f24-g86g

medium2026-03-31

CVE-2025-64340-FastMCP has a Command Injection vulnerability - Gemini CLI

prefecthq/fastmcp · GHSA-m8x7-r2rg-vh5g

high2026-03-31

CVE-2025-32957-baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)

baserproject/basercms · GHSA-hv78-cwp4-8r7r

critical2026-03-31

CVE-2026-0596-Mlflow: Command Injection when serving models with enable_mlserver=True

mlflow/mlflow · GHSA-rvhj-8chj-8v3c