Security advisories

high2026-03-23

CVE-2026-32276-Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin

opensource-workshop/connect-cms · GHSA-hxqw-6qv7-cqfv

medium2026-03-23

CVE-2026-30886-New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check

quantumnous/new-api · GHSA-f35r-v9x5-r8mc

critical2026-03-23

CVE-2026-30849-MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL

mantisbt/mantisbt · GHSA-phrq-pc6r-f6gh

medium2026-03-23

CVE-2026-27131-Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground

putyourlightson/craft-sprig · GHSA-m59h-42jf-cphr

high2026-03-23

CVE-2026-26209-cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads

agronholm/cbor2 · GHSA-3c37-wwvx-h642

medium2026-03-23

CVE-2026-32879-New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure

quantumnous/new-api · GHSA-5353-f8fq-65vc

high2026-03-23

CVE-2026-24516-DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint

digitalocean/droplet-agent · GHSA-fh3m-562m-w4f6

medium2026-03-23

CVE-2026-4587-HybridAuth Has Improper SSL Certificate Validation in Curl HTTP Client

hybridauth/hybridauth · GHSA-r3hf-q3mf-7h6w

critical2026-03-23

CVE-2026-4404-Harbor allows the use of the default password for web UI login

goharbor/harbor · GHSA-hj7x-hmf2-hc2p

low2026-03-23

CVE-2026-4633-Keycloak's identity-first login flow exposes user information

keycloak/keycloak · GHSA-rhgq-f8x5-j2jc

medium2026-03-23

CVE-2026-28809-esaml XXE vulnerability allows local file disclosure and SSRF via crafted SAML messages

arekinath/esaml · GHSA-4g2h-vm7x-747c

medium2026-03-23

CVE-2026-4628-Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false

keycloak/keycloak · GHSA-4pgc-gfrr-wcmg

high2026-03-23

CVE-2026-4600-jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic

kjur/jsrsasign · GHSA-wvqx-v3f6-w8rh

high2026-03-23

CVE-2026-4601-jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction

kjur/jsrsasign · GHSA-w8q8-93cx-6h7r

high2026-03-23

CVE-2026-4602-jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass

kjur/jsrsasign · GHSA-8qwj-4jxw-m8jw

high2026-03-23

CVE-2026-4598-jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs

kjur/jsrsasign · GHSA-8g7p-jf3g-gxcp

critical2026-03-23

CVE-2026-4599-jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation

kjur/jsrsasign · GHSA-5jx8-q4cp-rhh6

low2026-03-23

CVE-2026-4603-jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations

kjur/jsrsasign · GHSA-464q-cqxq-xhgr

low2026-03-22

CVE-2026-4539-Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

pygments/pygments · GHSA-5239-wwwm-4pmq

medium2026-03-22

CVE-2026-4531-Free5GC AMF is vulnerable to DoS through its HandleRegistrationComplete function

free5gc/amf · GHSA-xq44-64rg-8g3h