Security advisories

medium2026-03-24

CVE-2026-54685-FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

gtsteffaniak/filebrowser · GHSA-7789-65hx-f26w

medium2026-03-24

CVE-2026-33635-iCalendar has ICS injection via unsanitized URI property values

icalendar/icalendar · GHSA-pv9c-9mfh-hvxq

high2026-03-24

CVE-2026-33539-Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter

parse-community/parse-server · GHSA-p2w6-rmh7-w8q3

high2026-03-24

CVE-2026-33538-Parse Server: Denial of Service via unindexed database query for unconfigured auth providers

parse-community/parse-server · GHSA-g4cf-xj29-wqqr

high2026-03-24

fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing

webauthn-open-source/fido2-lib · GHSA-g3qj-j598-cxmq

critical2026-03-24

CVE-2026-33634-Trivy ecosystem supply chain was briefly compromised

aquasecurity/trivy · GHSA-69fq-xp46-6x23

medium2026-03-24

CVE-2026-33162-Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions

craftcms/cms · GHSA-f582-6gf6-gx4g

low2026-03-24

CVE-2026-33161-Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users

craftcms/cms · GHSA-vgjg-248p-rfm2

low2026-03-24

CVE-2026-33160-Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL

craftcms/cms · GHSA-5pgf-h923-m958

medium2026-03-24

CVE-2026-33159-Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations

craftcms/cms · GHSA-6mrr-q3pj-h53w

medium2026-03-24

CVE-2026-33158-Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)

craftcms/cms · GHSA-3pvf-vxrv-hh9c

high2026-03-24

CVE-2026-33157-Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior

craftcms/cms · GHSA-2fph-6v5w-89hh

high2026-03-24

CVE-2026-30932-Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

froxlor/froxlor · GHSA-x6w6-2xwp-3jh6

medium2026-03-24

CVE-2026-33528-GoDoxy has a Path Traversal Vulnerability in its File API

yusing/godoxy · GHSA-4753-cmc8-8j9v

medium2026-03-24

CVE-2026-33527-Parse Server's Session Update endpoint allows overwriting server-generated session fields

parse-community/parse-server · GHSA-jc39-686j-wp6q

low2026-03-24

CVE-2026-33525-Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting

authelia/authelia · GHSA-gmfg-3v4q-9qr4

medium2026-03-24

CVE-2026-32948-sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows

sbt/sbt · GHSA-x4ff-q6h8-v7gw

medium2026-03-24

CVE-2026-30662-ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads

concretecms/concretecms · GHSA-p68c-rmfh-j48h

low2026-03-24

CVE-2026-32642-Apache Artemis: Unauthorized Temporary Address Creation via OpenWire Protocol

apache/artemis · GHSA-f4gc-mwrg-q36r

medium2026-03-24

CVE-2026-3260-Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests

undertow-io/undertow · GHSA-3x3v-w654-m28m