Security advisories

medium2026-03-25

CVE-2026-27656-Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw

mattermost/mattermost · GHSA-fg35-5rf6-qg3g

medium2026-03-25

CVE-2026-26233-Mattermost doesn't rate limit login requests, allowing DoS

mattermost/mattermost · GHSA-247x-7qw8-fp98

medium2026-03-25

CVE-2026-20719-Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds

mattermost/mattermost · GHSA-86vc-mg26-fj6x

critical2026-03-25

CVE-2026-26833-thumbler allows OS Command Injection

mmahrous/thumbler · GHSA-mvhf-547c-h55r

critical2026-03-25

CVE-2026-26831-textract is vulnerable to OS Command Injection

dbashford/textract · GHSA-9pcj-m5rr-p28g

critical2026-03-25

CVE-2026-26832-node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter

zapolnoch/node-tesseract-ocr · GHSA-8j44-735h-w4w2

high2026-03-25

CVE-2026-33651-AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()

wwbn/avideo · GHSA-pvw4-p2jm-chjm

high2026-03-25

CVE-2026-33650-AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion

wwbn/avideo · GHSA-8x77-f38v-4m5j

high2026-03-25

CVE-2026-33649-AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification

wwbn/avideo · GHSA-g8x9-7mgh-7cvj

high2026-03-25

CVE-2026-33648-AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path

wwbn/avideo · GHSA-5m4q-5cvx-36mw

high2026-03-25

CVE-2026-33647-AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

wwbn/avideo · GHSA-wxjw-phj6-g75w

high2026-03-25

CVE-2026-33287-LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern

harttle/liquidjs · GHSA-6q5m-63h6-5x4v

high2026-03-25

CVE-2026-33285-LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash

harttle/liquidjs · GHSA-9r5m-9576-7f6x

low2026-03-25

@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling

nick-pape/grackle · GHSA-8g29-8xwr-qmhr

low2026-03-25

@grackle-ai/server has a Missing Secure Flag on Session Cookie

nick-pape/grackle · GHSA-5j35-xr4g-vwf4

medium2026-03-25

@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers

nick-pape/grackle · GHSA-3mjm-x6gw-2x42

medium2026-03-25

@grackle-ai/powerline Runs Without Authentication by Default

nick-pape/grackle · GHSA-xq7h-vwjp-5vrh

high2026-03-25

@grackle-ai/server has Missing WebSocket Origin Header Validation

nick-pape/grackle · GHSA-w3hv-x4fp-6h6j

high2026-03-25

@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool

nick-pape/grackle · GHSA-647h-p824-99w7

low2026-03-25

@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template

nick-pape/grackle · GHSA-7q9x-8g6p-3x75