Security advisories

high2026-03-25

CVE-2026-27889-NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead

nats-io/nats-server · GHSA-pq2q-rcw4-3hr6

high2026-03-25

CVE-2026-27602-Modoboa has OS Command Injection

modoboa/modoboa · GHSA-wwv8-cqpr-vx3m

high2026-03-25

CVE-2026-27496-n8n has In-Process Memory Disclosure in its Task Runner

n8n-io/n8n · GHSA-xvh5-5qg4-x9qp

medium2026-03-25

CVE-2026-25645-Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

psf/requests · GHSA-gc5v-m9x4-r6x2

critical2026-03-25

CVE-2026-26830-pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter

mooz/node-pdf-image · GHSA-q5mh-72xg-628w

critical2026-03-25

Two LiteLLM versions published containing credential harvesting malware

berriai/litellm · GHSA-5mg7-485q-xm76

medium2026-03-24

CVE-2026-33638-Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint

lin-snow/ech0 · GHSA-m983-7426-5hrj

medium2026-03-24

Scriban has Multiple Denial-of-Service Vectors via Unbounded Resource Consumption During Expression Evaluation

scriban/scriban · GHSA-xw6w-9jjh-p9cr

medium2026-03-24

Scriban: Denial of Service via Unbounded Cumulative Template Output Bypassing LimitToString

scriban/scriban · GHSA-m2p3-hwv5-xpqw

high2026-03-24

Scriban has Uncontrolled Recursion in `object.to_json` Causing Unrecoverable Process Crash via StackOverflowException

scriban/scriban · GHSA-xcx6-vp38-8hr5

high2026-03-24

Scriban: Uncontrolled Memory Allocation via string.pad_left/pad_right Allows Remote Denial of Service

scriban/scriban · GHSA-v66j-x4hw-fv9g

high2026-03-24

Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service

scriban/scriban · GHSA-c875-h985-hvrc

critical2026-03-24

Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse

scriban/scriban · GHSA-5wr9-m6jw-xx44

high2026-03-24

Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset()

scriban/scriban · GHSA-x6m9-38vm-2xhf

high2026-03-24

Scriban has a Stack Overflow via Nested Array Initializers That Bypass the ExpressionDepthLimit Fix

scriban/scriban · GHSA-p6q4-fgr8-vx4p

medium2026-03-24

CVE-2026-33248-NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching

nats-io/nats-server · GHSA-3f24-pcvm-5jqc

medium2026-03-24

CVE-2026-33246-NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

nats-io/nats-server · GHSA-55h8-8g96-x4hj

medium2026-03-24

CVE-2026-33223-NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

nats-io/nats-server · GHSA-pwx7-fx9r-hr4h

medium2026-03-24

CVE-2026-33222-NATS JetStream has an authorization bypass through its Management API

nats-io/nats-server · GHSA-9983-vrx2-fg9c

medium2026-03-24

CVE-2026-33219-NATS is vulnerable to pre-auth DoS through WebSockets client service

nats-io/nats-server · GHSA-8r68-gvr4-jh7j