Security advisories

critical2026-03-26

CVE-2026-33863-Convict has prototype pollution via load(), loadFile(), and schema initialization

mozilla/node-convict · GHSA-hf2r-9gf9-rwch

high2026-03-26

CVE-2026-33871-Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

netty/netty · GHSA-w9fj-cfpg-grvv

high2026-03-26

CVE-2026-33870-Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

netty/netty · GHSA-pwqr-wmgm-9rr8

low2026-03-26

CVE-2026-33769-Astro: Remote allowlist bypass via unanchored matchPathname wildcard

withastro/astro · GHSA-g735-7g2w-hh3f

medium2026-03-26

CVE-2026-33768-Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`

withastro/astro · GHSA-mr6q-rp88-fx84

critical2026-03-26

CVE-2026-33758-OpenBao has Reflected XSS in its OIDC authentication error message

openbao/openbao · GHSA-cpj3-3r2f-xj59

critical2026-03-26

CVE-2026-33757-OpenBao lacks user confirmation for OIDC direct callback mode

openbao/openbao · GHSA-7q7g-x6vg-xpc3

medium2026-03-26

CVE-2026-3114-Mattermost doesn't validate decompressed archive entry sizes during file extraction

mattermost/mattermost · GHSA-vhgh-g7x8-4rx8

medium2026-03-26

CVE-2026-3115-Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scope

mattermost/mattermost · GHSA-mpc7-mm28-f6wq

medium2026-03-26

CVE-2026-3113-Mattermost doesn't set permissions on downloaded bulk export

mattermost/mattermost · GHSA-4765-v66x-rqx7

medium2026-03-26

CVE-2026-3112-Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration

mattermost/mattermost · GHSA-3mw5-466q-295q

high2026-03-26

CVE-2026-3108-Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences

mattermost/mattermost · GHSA-3439-vqgj-2gcf

high2026-03-26

CVE-2026-32846-OpenClaw is vulnerable to Path Traversal through path validation bypass

openclaw/openclaw · GHSA-hggm-x7r9-mm7v

critical2026-03-26

CVE-2026-33873-Langflow has Authenticated Code Execution in Agentic Assistant Validation

langflow-ai/langflow · GHSA-v8hw-mh8c-jxfc

medium2026-03-26

CVE-2026-33751-n8n Vulnerable to LDAP Filter Injection in LDAP Node

n8n-io/n8n · GHSA-w83q-mcmx-mh42

medium2026-03-26

CVE-2026-33750-brace-expansion: Zero-step sequence causes process hang and memory exhaustion

juliangruber/brace-expansion · GHSA-f886-m6hf-6m8v

medium2026-03-26

CVE-2026-33749-n8n Vulnerable to XSS via Binary Data Inline HTML Rendering

n8n-io/n8n · GHSA-qfc3-hm4j-7q77

high2026-03-26

CVE-2026-33748-BuildKit Git URL subdir component can cause access to restricted files

moby/buildkit · GHSA-4vrq-3vrq-g6gg

high2026-03-26

CVE-2026-33747-BuildKit's Malicious frontend can cause file escape outside of storage root

moby/buildkit · GHSA-4c29-8rgm-jvjj

high2026-03-26

CVE-2026-33872-elixir-nodejs has Cross-User Data Leakage or Information Disclosure due to Worker Protocol Race Condition

revelrylabs/elixir-nodejs · GHSA-rwcr-rpcc-3g9m