Security advisories

critical2026-03-20

CVE-2026-33286-Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names

graphiti-api/graphiti · GHSA-3m5v-4xp5-gjg2

high2026-03-20

CVE-2026-32711-pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root

pydicom/pydicom · GHSA-v856-2rf8-9f28

high2026-03-20

CVE-2026-32701-Qwik City has array method pollution in FormData processing allows type confusion and DoS

qwikdev/qwik · GHSA-whhv-gg5v-864r

medium2026-03-20

CVE-2026-32595-Traefik Affected by BasicAuth Middleware Timing Attack Allows Username Enumeration

traefik/traefik · GHSA-g3hg-j4jv-cwfr

high2026-03-20

CVE-2026-32305-Traefik has a Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config

traefik/traefik · GHSA-wvvq-wgcr-9q48

medium2026-03-20

CVE-2026-29794-Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

go-vikunja/vikunja · GHSA-m547-hp4w-j6jx

high2026-03-20

CVE-2026-22733-Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints

spring-projects/spring-boot · GHSA-mgvc-8q2h-5pgc

critical2026-03-20

CVE-2026-22732-Spring Security HTTP Headers Are not Written Under Some Conditions

spring-projects/spring-security · GHSA-mf92-479x-3373

high2026-03-20

CVE-2026-4342-ingress-nginx comment-based nginx configuration injection

kubernetes/ingress-nginx · GHSA-f53h-mxv9-cp98

high2026-03-20

CVE-2026-22731-Spring Boot has an Authentication Bypass under Actuator Health groups paths

spring-projects/spring-boot · GHSA-8hfc-fq58-r658

low2026-03-20

CVE-2026-22735-Spring MVC and WebFlux has Server Sent Event stream corruption

spring-projects/spring-framework · GHSA-6hcq-hmm3-jj3c

medium2026-03-20

CVE-2026-22737-Spring Framework Improper Path Limitation with Script View Templates

spring-projects/spring-framework · GHSA-4773-3jfm-qmx3

high2026-03-19

CVE-2026-33409-Parse Server has an auth provider validation bypass on login via partial authData

parse-community/parse-server · GHSA-pfj7-wv7c-22pr

medium2026-03-19

Scriban Affected by Memory Exhaustion (OOM) via Unbounded String Generation (Denial of Service)

scriban/scriban · GHSA-5rpf-x9jg-8j5p

high2026-03-19

Scriban has an Infinite Recursion during Object Rendering Leads to Stack Overflow and Process Crash (Denial of Service)

scriban/scriban · GHSA-grr9-747v-xvcp

high2026-03-19

Scriban has Uncontrolled Recursion in Parser Leads to Stack Overflow and Process Crash (Denial of Service)

scriban/scriban · GHSA-wgh7-7m3c-fx25

medium2026-03-19

CVE-2026-33397-Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR

angular/angular-cli · GHSA-vfx2-hv2g-xj5f

medium2026-03-19

CVE-2026-4267-The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI

johnbillion/query-monitor · GHSA-2xr4-chcf-vmvf

high2026-03-19

CVE-2026-33354-AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`

wwbn/avideo · GHSA-4jw9-5hrc-m4j6

high2026-03-19

CVE-2026-33353-In Soft Serve, an authenticated repo import can clone server-local private repositories

charmbracelet/soft-serve · GHSA-xgxp-f695-6vrp