Security advisories

medium2026-03-30

CVE-2026-34369-AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification

wwbn/avideo · GHSA-q6jj-r49p-94fh

medium2026-03-30

CVE-2026-34368-AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance

wwbn/avideo · GHSA-h54m-c522-h6qr

medium2026-03-30

CVE-2026-34364-AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php

wwbn/avideo · GHSA-73gr-r64q-7jh4

high2026-03-30

CVE-2026-34363-LiveQuery protected field leak via shared mutable state across concurrent subscribers

parse-community/parse-server · GHSA-m983-v2ff-wq65

medium2026-03-30

CVE-2026-34362-AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()

wwbn/avideo · GHSA-2mg4-pfgx-64cf

medium2026-03-30

CVE-2026-34237-MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)

modelcontextprotocol/java-sdk · GHSA-hv2w-8mjj-jw22

critical2026-03-30

CVE-2026-34361-FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

hapifhir/org.hl7.fhir.core · GHSA-vr79-8m62-wh98

medium2026-03-30

CVE-2026-34360-FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing

hapifhir/org.hl7.fhir.core · GHSA-3ww8-jw56-9f5h

medium2026-03-30

CVE-2026-34231-Slippers Vulnerable to Cross-Site Scripting (XSS) in `attrs` Template Tag

mixxorz/slippers · GHSA-w7rv-gfp4-j9j3

high2026-03-30

CVE-2026-34359-HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect

hapifhir/org.hl7.fhir.core · GHSA-fgv2-4q4g-wc35

medium2026-03-30

CVE-2026-34165-go-git: Maliciously crafted idx file can cause asymmetric memory consumption

go-git/go-git · GHSA-jhf3-xxhw-2wpp

critical2026-03-30

CVE-2026-34156-NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

nocobase/nocobase · GHSA-px3p-vgh9-m57c

medium2026-03-30

CVE-2026-33990-Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)

docker/model-runner · GHSA-x2f5-332j-9xwq

high2026-03-30

CVE-2026-33949-@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files

tinacms/tinacms · GHSA-v9p7-gf3q-h779

low2026-03-30

CVE-2026-33762-go-git missing validation decoding Index v4 files leads to panic

go-git/go-git · GHSA-gm2x-2g9h-ccm8

high2026-03-30

CVE-2026-33641-Glances Vulnerable to Command Injection via Dynamic Configuration Values

nicolargo/glances · GHSA-qhj7-v7h7-q4c7

high2026-03-30

CVE-2026-33533-Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

nicolargo/glances · GHSA-7p93-6934-f4q7

critical2026-03-30

CVE-2026-33032-nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

0xjacky/nginx-ui · GHSA-h6c2-x2m2-mwhf

high2026-03-30

CVE-2026-33030-nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys

0xjacky/nginx-ui · GHSA-5hf2-vhj6-gj9m

medium2026-03-30

CVE-2026-33029-nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval

0xjacky/nginx-ui · GHSA-cp8r-8jvw-v3qg