Security advisories

high2026-03-24

CVE-2026-22739-Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access

spring-cloud/spring-cloud-config · GHSA-3qwq-q9vm-5j42

medium2026-03-23

H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation

h3js/h3 · GHSA-fp4x-ggrf-wmc6

medium2026-03-23

CVE-2026-86250-H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service

h3js/h3 · GHSA-q5pr-72pq-83v3

medium2026-03-23

CVE-2026-33486-Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents

roadiz/core-bundle-dev-app · GHSA-rc55-58f4-687g

high2026-03-23

CVE-2026-33430-Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions

beeware/briefcase · GHSA-r3r2-35v9-v238

medium2026-03-23

CVE-2026-33202-Rails Active Storage has possible glob injection in its DiskService

rails/rails · GHSA-73f9-jhhh-hr5m

high2026-03-23

CVE-2026-33195-Rails Active Storage has possible Path Traversal in DiskService

rails/rails · GHSA-9xrj-h377-fr87

medium2026-03-23

CVE-2026-33176-Rails Active Support has a possible DoS vulnerability in its number helpers

rails/rails · GHSA-2j26-frm8-cmj9

medium2026-03-23

CVE-2026-33174-Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

rails/rails · GHSA-r46p-8f7g-vvvg

medium2026-03-23

CVE-2026-33173-Rails Active Storage has possible content type bypass via metadata in direct uploads

rails/rails · GHSA-qcfx-2mfw-w4cg

medium2026-03-23

CVE-2026-33170-Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

rails/rails · GHSA-89vf-4333-qx8v

medium2026-03-23

CVE-2026-33169-Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

rails/rails · GHSA-cg4j-q9v8-6v38

low2026-03-23

CVE-2026-33168-Rails has a possible XSS vulnerability in its Action View tag helpers

rails/rails · GHSA-v55j-83pf-r9cq

low2026-03-23

CVE-2026-33167-Rails has a possible XSS vulnerability in its Action Pack debug exceptions

rails/rails · GHSA-pgm4-439c-5jp6

high2026-03-23

CVE-2026-33046-Indico discloses local files resulting in Remote Code Execution through LaTeX injection

indico/indico · GHSA-rm2q-f7jv-3cfp

high2026-03-23

CVE-2026-32300-Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information

opensource-workshop/connect-cms · GHSA-qr6x-wvxr-8hm9

high2026-03-23

CVE-2026-32299-Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature

opensource-workshop/connect-cms · GHSA-62ch-j6x7-722j

medium2026-03-23

CVE-2026-32279-Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin

opensource-workshop/connect-cms · GHSA-jh46-85jr-6ph9

high2026-03-23

CVE-2026-32278-Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin

opensource-workshop/connect-cms · GHSA-mv3p-7p89-wq9p

high2026-03-23

CVE-2026-32277-Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View

opensource-workshop/connect-cms · GHSA-cmfh-mpmf-fmq4