Security advisories

critical2026-03-29

CVE-2026-34220-MikroORM is vulnerable to SQL Injection via specially crafted object

mikro-orm/mikro-orm · GHSA-gwhv-j974-6fxm

medium2026-03-29

CVE-2026-34247-AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications

wwbn/avideo · GHSA-g3hj-mf85-679g

medium2026-03-29

CVE-2026-34245-AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking

wwbn/avideo · GHSA-2rm7-j397-3fqg

high2026-03-29

CVE-2026-56341-AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records

wwbn/avideo · GHSA-wprj-9cvc-5w37

critical2026-03-29

CVE-2026-34243-wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`

njzjz/wenxian · GHSA-r4fj-r33x-8v88

high2026-03-29

Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)

traefik/traefik · GHSA-46wh-3698-f2cx

medium2026-03-29

OpenCC has an Out-of-bounds read when processing truncated UTF-8 input

byvoid/opencc · GHSA-7fqq-q52p-2jjg

high2026-03-29

Sliver: Nil Pointer Dereference in tunnelCloseHandler causes panic when a reverse tunnel (rportfwd) close is attempted

bishopfox/sliver · GHSA-c279-989m-238f

high2026-03-29

CVE-2026-34226-Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

capricorn86/happy-dom · GHSA-w4gp-fjgq-3q4g

low2026-03-29

CVE-2026-34224-Parse Server has an MFA single-use token bypass via concurrent authData login requests

parse-community/parse-server · GHSA-w73w-g5xw-rwhf

low2026-03-29

CVE-2026-73427-Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)

basecamp/trix · GHSA-53p3-c7vp-4mcc

critical2026-03-29

mpp has multiple payment bypass and griefing vulnerabilities

tempoxyz/mpp-rs · GHSA-fxc9-7j2w-vx54

high2026-03-29

CVE-2026-32287-XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion

antchfx/xpath · GHSA-65xw-vw82-r86x

medium2026-03-29

Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry

handlebars-lang/handlebars.js · GHSA-7rx3-28cr-v5wh

low2026-03-29

Handlebars.js has a Property Access Validation Bypass in container.lookup

handlebars-lang/handlebars.js · GHSA-442j-39wm-28r2

critical2026-03-29

mppx has multiple payment bypass and griefing vulnerabilities

wevm/mppx · GHSA-8x4m-qw58-3pcx

high2026-03-29

CVE-2026-34215-Parse Server exposes auth data via verify password endpoint

parse-community/parse-server · GHSA-wp76-gg32-8258

high2026-03-29

CVE-2026-34214-Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

trinodb/trino · GHSA-x27p-5f68-m644

medium2026-03-29

CVE-2026-34210-mppx has Stripe charge credential replay via missing idempotency check

wevm/mppx · GHSA-8mhj-rffc-rcvw

high2026-03-29

CVE-2026-34209-mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

wevm/mppx · GHSA-mv9j-8jvg-j8mr