Security advisories

high2026-03-27

CVE-2026-33941-Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

handlebars-lang/handlebars.js · GHSA-xjpj-3mr7-gcpf

high2026-03-27

CVE-2026-33940-Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

handlebars-lang/handlebars.js · GHSA-xhpv-hc6g-r9c6

high2026-03-27

CVE-2026-33939-Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

handlebars-lang/handlebars.js · GHSA-9cx6-37pm-9jff

high2026-03-27

CVE-2026-33938-Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

handlebars-lang/handlebars.js · GHSA-3mfm-83xf-c92r

critical2026-03-27

CVE-2026-33937-Handlebars.js has JavaScript Injection via AST Type Confusion

handlebars-lang/handlebars.js · GHSA-2w6w-674q-4c4q

medium2026-03-27

CVE-2026-34043-Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

yahoo/serialize-javascript · GHSA-qj8w-gfj5-8c6v

high2026-03-27

CVE-2026-26061-Fleet's unbounded request body read allows remote Denial of Service

fleetdm/fleet · GHSA-99hj-44vg-hfcp

medium2026-03-27

CVE-2026-26060-Fleet: Password reset tokens remain valid after password change for 24 hours

fleetdm/fleet · GHSA-3458-r943-hmx4

medium2026-03-27

n8n has XSS in its Credential Management Flow

n8n-io/n8n · GHSA-364x-8g5j-x2pr

medium2026-03-27

n8n has XSS in Chat Trigger Node through Custom CSS

n8n-io/n8n · GHSA-3c7f-5hgj-h279

medium2026-03-27

n8n: Authenticated XSS and Open Redirect via Form Node

n8n-io/n8n · GHSA-w673-8fjw-457c

medium2026-03-27

CVE-2026-56358-n8n has a Stored XSS Vulnerability in its Form Trigger

n8n-io/n8n · GHSA-q4fm-pjq6-m63g

medium2026-03-27

CVE-2026-34036-Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php

dolibarr/dolibarr · GHSA-2mfj-r695-5h9r

critical2026-03-27

CVE-2026-33992-pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

pyload/pyload · GHSA-m74m-f7cr-432x

medium2026-03-27

CVE-2026-33994-Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521

locutusjs/locutus · GHSA-vc8f-x9pp-wf5p

medium2026-03-27

CVE-2026-33993-Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

locutusjs/locutus · GHSA-4mph-v827-f877

high2026-03-27

CVE-2026-33979-Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

ahmedadelfahim/express-xss-sanitizer · GHSA-3843-rr4g-m8jq

medium2026-03-27

CVE-2026-32695-Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass

traefik/traefik · GHSA-67jx-r9pv-98rj

high2026-03-27

CVE-2026-34040-Moby has AuthZ plugin bypass when provided oversized request bodies

moby/moby · GHSA-x744-4wpc-v9h2

medium2026-03-27

CVE-2026-33997-Moby has an Off-by-one error in its plugin privilege validation

moby/moby · GHSA-pxq6-2prw-chj9