Security advisories

medium2026-03-20

PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS

pdfme/pdfme · GHSA-vrqm-gvq7-rrwh

high2026-03-20

CVE-2026-33421-Parse Server's LiveQuery bypasses CLP pointer permission enforcement

parse-community/parse-server · GHSA-fph2-r4qg-9576

high2026-03-20

CVE-2026-33480-AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy

wwbn/avideo · GHSA-p3gr-g84w-g8hh

high2026-03-20

CVE-2026-33479-AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

wwbn/avideo · GHSA-xggw-g9pm-9qhh

critical2026-03-20

CVE-2026-33478-AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

wwbn/avideo · GHSA-687q-32c6-8x68

high2026-03-20

CVE-2026-33476-Siyuan has an Unauthenticated Arbitrary File Read via Path Traversal

siyuan-note/siyuan · GHSA-hhgj-gg9h-rjp7

medium2026-03-20

CVE-2026-33474-Vikunja Affected by DoS via Image Preview Generation

go-vikunja/vikunja · GHSA-wc83-79hj-hpmq

medium2026-03-20

CVE-2026-33473-Vikunja has TOTP Reuse During Validity Window

go-vikunja/vikunja · GHSA-p747-qc5p-773r

high2026-03-20

CVE-2026-33418-SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()

dicebear/dicebear · GHSA-7j2x-32w6-p43p

high2026-03-20

CRL Distribution Point Scope Check Logic Error in AWS-LC

aws/aws-lc-rs · GHSA-9f94-5g5w-gf6r

high2026-03-20

AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN

aws/aws-lc-rs · GHSA-394x-vwmw-crm3

low2026-03-20

CVE-2026-33343-etcd: Nested etcd transactions bypass RBAC authorization checks

etcd-io/etcd · GHSA-rfx7-8w68-q57q

high2026-03-20

CVE-2026-32887-Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC

effect-ts/effect · GHSA-38f7-945m-qr2g

high2026-03-20

CVE-2026-33331-oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify

middleapi/orpc · GHSA-7f6v-3gx7-27q8

high2026-03-20

CVE-2026-33316-Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement

go-vikunja/vikunja · GHSA-vq4q-79hh-q767

medium2026-03-20

CVE-2026-33315-Vikunja has a 2FA Bypass via Caldav Basic Auth

go-vikunja/vikunja · GHSA-47cr-f226-r4pq

medium2026-03-20

CVE-2026-33313-Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments

go-vikunja/vikunja · GHSA-mr3j-p26x-72x4

medium2026-03-20

CVE-2026-33312-Vikunja read-only users can delete project background images via broken object-level authorization

go-vikunja/vikunja · GHSA-564f-wx8x-878h

medium2026-03-20

CVE-2026-33056-tar-rs `unpack_in` can chmod arbitrary directories by following symlinks

alexcrichton/tar-rs · GHSA-j4xf-2g29-59ph

medium2026-03-20

CVE-2026-33055-tar-rs incorrectly ignores PAX size headers if header size is nonzero

alexcrichton/tar-rs · GHSA-gchp-q4r4-x4ff