Security advisories

high2026-03-20

CVE-2026-33496-Ory Oathkeeper has an authentication bypass by cache key confusion

ory/oathkeeper · GHSA-4mq7-pvjg-xp2r

medium2026-03-20

CVE-2026-33495-Ory Oathkeeper has an authentication bypass by usage of untrusted header

ory/oathkeeper · GHSA-vhr5-ggp3-qq85

medium2026-03-20

h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)

h3js/h3 · GHSA-4hxc-9384-m385

low2026-03-20

CVE-2026-33490-h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

h3js/h3 · GHSA-2j6q-whv2-gh6w

medium2026-03-20

h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`

h3js/h3 · GHSA-72gr-qfp7-vwhw

high2026-03-20

CVE-2026-33493-AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter

wwbn/avideo · GHSA-83xq-8jxj-4rxm

high2026-03-20

CVE-2026-33492-AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration

wwbn/avideo · GHSA-x3pr-vrhq-vq43

high2026-03-20

CVE-2026-33488-AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin

wwbn/avideo · GHSA-6m5f-j7w2-w953

high2026-03-20

CVE-2026-33468-Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings

kysely-org/kysely · GHSA-8cpq-38p9-67gx

high2026-03-20

CVE-2026-33442-Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.

kysely-org/kysely · GHSA-fr9j-6mvq-frcv

high2026-03-20

CVE-2026-33413-etcd: Authorization bypasses in multiple APIs

etcd-io/etcd · GHSA-q8m4-xhhv-38mg

critical2026-03-20

CVE-2026-33419-MinIO LDAP login brute-force via user enumeration and missing rate limit

minio/minio · GHSA-jv87-32hw-hh99

high2026-03-20

CVE-2026-33485-AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter

wwbn/avideo · GHSA-8p58-35c3-ccxx

high2026-03-20

CVE-2026-33484-langflow has Unauthenticated IDOR on Image Downloads

langflow-ai/langflow · GHSA-7grx-3xcx-2xv5

high2026-03-20

CVE-2026-33483-AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php

wwbn/avideo · GHSA-vv7w-qf5c-734w

high2026-03-20

CVE-2026-33482-AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()

wwbn/avideo · GHSA-pmj8-r2j7-xg6c

medium2026-03-20

CVE-2026-33481-Syft improper temporary file cleanup

anchore/syft · GHSA-rjcw-vg7j-m9rc

medium2026-03-20

CVE-2026-33429-Parse Server has a protected field change detection oracle via LiveQuery watch parameter

parse-community/parse-server · GHSA-qpc3-fg4j-8hgm

medium2026-03-20

PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled

pdfme/pdfme · GHSA-pgx6-7jcq-2qff

medium2026-03-20

PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel

pdfme/pdfme · GHSA-xgx4-2wgv-4jhm