Security advisories

medium2026-03-21

CVE-2026-3864-NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter

kubernetes-csi/csi-driver-nfs · GHSA-2mjq-54qg-7w6j

low2026-03-21

CVE-2026-4506-MindSQL is vulnerable to Code Injection through its ask_db function

mindinventory/mindsql · GHSA-m6m4-34cj-4hh7

high2026-03-20

CVE-2026-33513-AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

wwbn/avideo · GHSA-8fw8-q79c-fp9m

high2026-03-20

CVE-2026-33512-AVideo has an unauthenticated decrypt oracle leaking any ciphertext

wwbn/avideo · GHSA-mwjc-5j4x-r686

medium2026-03-20

webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic

rustls/webpki · GHSA-pwjx-qhcg-rvj4

high2026-03-20

CVE-2026-33509-pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

pyload/pyload · GHSA-r7mc-x6x7-cqxx

high2026-03-20

CVE-2026-33508-Parse Server LiveQuery subscription query depth bypass

parse-community/parse-server · GHSA-6qh5-m6g3-xhq6

high2026-03-20

CVE-2026-33507-AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

wwbn/avideo · GHSA-hv36-p4w4-6vmj

critical2026-03-20

Zen-AI-Pentest has Shell Injection via untrusted issue title in ZenClaw Discord Integration workflow

shadd0wtaka/zen-ai-pentest · GHSA-f67f-hcr6-94mf

high2026-03-20

CVE-2025-55988-DreamFactory has a directory traversal

dreamfactorysoftware/df-core · GHSA-gv7f-w92j-383q

critical2026-03-20

CVE-2026-33502-AVideo has Unauthenticated SSRF via plugin/Live/test.php

wwbn/avideo · GHSA-3fpm-8rjr-v5mc

medium2026-03-20

CVE-2026-33501-AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin

wwbn/avideo · GHSA-96qp-8cmq-jvq8

medium2026-03-20

CVE-2026-33500-AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization

wwbn/avideo · GHSA-72h5-39r7-r26j

medium2026-03-20

CVE-2026-33499-AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php

wwbn/avideo · GHSA-7292-w8qp-mhq2

high2026-03-20

CVE-2026-33498-Parse Server has a query condition depth bypass via pre-validation transform pipeline

parse-community/parse-server · GHSA-9fjp-q3c4-6w3j

high2026-03-20

CVE-2026-33497-langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading

langflow-ai/langflow · GHSA-ph9w-r52h-28p7

high2026-03-20

CVE-2026-33505-Ory Keto has a SQL injection via forged pagination tokens

ory/keto · GHSA-c38g-mx2c-9wf2

high2026-03-20

CVE-2026-33504-Ory Hydra has a SQL injection via forged pagination tokens

ory/hydra · GHSA-r9w3-57w2-gch2

high2026-03-20

CVE-2026-33503-Ory Kratos has a SQL injection via forged pagination tokens

ory/kratos · GHSA-hgx2-28f8-6g2r

critical2026-03-20

CVE-2026-33494-Ory Oathkeeper has a path traversal authorization bypass

ory/oathkeeper · GHSA-p224-6x5r-fjpm