Security advisories

medium2026-03-25

CVE-2026-33699-pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

py-pdf/pypdf · GHSA-87mj-5ggw-8qc3

low2026-03-25

CVE-2026-33529-Zoraxy: Authenticated Path Traversal in Config Import leads to RCE

tobychui/zoraxy · GHSA-7pq3-326h-f8q9

high2026-03-25

CVE-2026-33686-Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil

code16/sharp · GHSA-9ffq-6457-8958

high2026-03-25

CVE-2026-33687-Sharp has Unrestricted File Upload via Client-Controlled Validation Rules

code16/sharp · GHSA-fr76-5637-w3g9

high2026-03-25

CVE-2026-33517-MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation

mantisbt/mantisbt · GHSA-fh48-f69w-7vmp

medium2026-03-25

CVE-2026-33690-AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()

wwbn/avideo · GHSA-8p2x-5cpm-qrqw

medium2026-03-25

AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php

wwbn/avideo · GHSA-wxjx-r2j2-96fx

medium2026-03-25

CVE-2026-33688-AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

wwbn/avideo · GHSA-m99f-mmvg-3xmx

medium2026-03-25

CVE-2026-33685-AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data

wwbn/avideo · GHSA-j36m-74g2-7m95

medium2026-03-25

CVE-2026-33683-AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field

wwbn/avideo · GHSA-ghx5-7jjg-q2j7

high2026-03-25

CVE-2026-33681-AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name

wwbn/avideo · GHSA-3hwv-x8g3-9qpr

high2026-03-25

CVE-2026-33673-PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables

prestashop/prestashop · GHSA-35pf-37c6-jxjv

low2026-03-25

CVE-2026-33674-PrestaShop: Improper Use of Validation Framework

prestashop/prestashop · GHSA-283w-xf3q-788v

critical2026-03-25

CVE-2026-33670-SiYuan has directory traversal within its publishing service

siyuan-note/siyuan · GHSA-xmw9-6r43-x9ww

critical2026-03-25

CVE-2026-33669-SiYuan has Arbitrary Document Reading within the Publishing Service

siyuan-note/siyuan · GHSA-34xj-66v3-6j83

medium2026-03-25

CVE-2026-3635-fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

fastify/fastify · GHSA-444r-cwp2-x5xf

high2026-03-25

CVE-2026-33661-WeChat Pay callback signature verification bypassed when Host header is localhost

yansongda/pay · GHSA-q938-ghwv-8gvc

medium2026-03-25

CVE-2026-30587-Seafile Server has multiple stored XSS vulnerabilities

haiwen/seadoc-editor · GHSA-rqj3-x344-qvxc

high2026-03-25

CVE-2025-67030-Plexus-Utils has a Directory Traversal vulnerability in its extractFile method

codehaus-plexus/plexus-utils · GHSA-6fmv-xxpf-w3cw

medium2026-03-25

CVE-2026-27659-Mattermost doesn't properly validate CSRF tokens

mattermost/mattermost · GHSA-rmhw-c3xr-m3xx