Security advisories

high2026-03-24

CVE-2026-33218-NATS has pre-auth server panic via leafnode handling

nats-io/nats-server · GHSA-vprv-35vv-q339

high2026-03-24

CVE-2026-33217-NATS allows MQTT clients to bypass ACL checks

nats-io/nats-server · GHSA-jxxm-27vp-c3m5

high2026-03-24

CVE-2026-33216-NATS has MQTT plaintext password disclosure

nats-io/nats-server · GHSA-v722-jcv5-w7mc

medium2026-03-24

CVE-2026-33215-NATS is vulnerable to MQTT hijacking via Client ID

nats-io/nats-server · GHSA-fcjp-h8cc-6879

high2026-03-24

CVE-2026-24159-NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution

nvidia-nemo/nemo · GHSA-v7v2-m736-cf3c

high2026-03-24

CVE-2026-24157-NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading

nvidia-nemo/nemo · GHSA-m4jw-wgmf-889x

high2026-03-24

CVE-2026-29785-NATS Server panic via malicious compression on leafnode port

nats-io/nats-server · GHSA-52jh-2xxh-pwh6

high2026-03-24

CVE-2026-33247-NATS credentials are exposed in monitoring port via command-line argv

nats-io/nats-server · GHSA-x6g4-f6q3-fqvv

medium2026-03-24

CVE-2026-33628-Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items

invoiceninja/invoiceninja · GHSA-98wm-cxpw-847p

medium2026-03-24

CVE-2026-33249-NATS: Message tracing can be redirected to arbitrary subject

nats-io/nats-server · GHSA-8m2x-3m6q-6w8j

high2026-03-24

CVE-2026-33627-Parse Server exposes auth data via /users/me endpoint

parse-community/parse-server · GHSA-37mj-c2wf-cx96

low2026-03-24

CVE-2026-33624-Parse Server: MFA recovery code single-use bypass via concurrent requests

parse-community/parse-server · GHSA-2299-ghjr-6vjp

medium2026-03-24

CVE-2026-33621-PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token

pinchtab/pinchtab · GHSA-j65m-hv65-r264

medium2026-03-24

CVE-2026-33623-PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution

pinchtab/pinchtab · GHSA-p8mm-644p-phmh

medium2026-03-24

CVE-2026-33622-A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution

pinchtab/pinchtab · GHSA-w5pc-m664-r62v

medium2026-03-24

CVE-2026-33620-PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems

pinchtab/pinchtab · GHSA-mrqc-3276-74f8

medium2026-03-24

CVE-2026-33619-PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl

pinchtab/pinchtab · GHSA-xqq2-4j46-vwp7

medium2026-03-24

CVE-2026-29772-Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands

withastro/astro · GHSA-3rmj-9m5h-8fpv

medium2026-03-24

CVE-2026-33545-MobSF has SQL Injection in its SQLite Database Viewer Utils

mobsf/mobile-security-framework-mobsf · GHSA-hqjr-43r5-9q58

high2026-03-24

JustHTML is vulnerable to XSS via code fence breakout in <pre> content

emilstenstrom/justhtml · GHSA-5vp3-3cg6-2rq3