Security advisories

critical2026-03-19

CVE-2026-33352-AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

wwbn/avideo · GHSA-mcj5-6qr4-95fj

high2026-03-19

CVE-2026-33344-Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG

dagu-org/dagu · GHSA-ph8x-4jfv-v9v8

critical2026-03-19

CVE-2026-33351-AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass

wwbn/avideo · GHSA-5f7v-4f6g-74rj

medium2026-03-19

CVE-2026-33349-Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

naturalintelligence/fast-xml-parser · GHSA-jp2q-39xq-3w4g

medium2026-03-19

CVE-2026-33347-league/commonmark has an embed extension allowed_domains bypass

thephpleague/commonmark · GHSA-hh8v-hgvp-g3f5

medium2026-03-19

CVE-2026-33332-NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

zauberzeug/nicegui · GHSA-w5g8-5849-vj76

medium2026-03-19

CVE-2026-33326-@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)

keystonejs/keystone · GHSA-cgcg-q9jh-5pr2

medium2026-03-19

CVE-2026-26933-Packetbeat does not properly validate an array index in multiple protocol parser components

elastic/beats · GHSA-27qj-9gvp-8rh9

medium2026-03-19

CVE-2026-3029-PyMuPDF has a path traversal in _main_.py

pymupdf/pymupdf · GHSA-cxqh-p2w9-fmr7

medium2026-03-19

CVE-2026-26931-Metricbeat Allocates Memory with Excessive Size Value Leading to Denial of Service

elastic/beats · GHSA-5vrw-qjxw-89r5

medium2026-03-19

CVE-2026-33323-Parse Server email verification resend page leaks user existence

parse-community/parse-server · GHSA-h29g-q5c2-9h4f

high2026-03-19

skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version

kyamagu/skia-python · GHSA-2mhw-8qcg-gr96

critical2026-03-19

CVE-2026-33322-MinIO has JWT Algorithm Confusion in OIDC Authentication

minio/minio · GHSA-5cx5-wh4m-82fh

medium2026-03-19

CVE-2026-33314-Improper Authentication and Origin Validation Error in pyload-ng

pyload/pyload · GHSA-q485-cg9q-xq2r

medium2026-03-19

CVE-2026-33306-bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby

bcrypt-ruby/bcrypt-ruby · GHSA-f27w-vcwj-c954

medium2026-03-19

CVE-2026-33311-SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials

dicebear/dicebear · GHSA-mr9r-mww3-v6gv

medium2026-03-19

CVE-2026-33283-Ella Core panics on malformed ULNASTransport Message without a Request Type

ellanetworks/core · GHSA-3366-gw57-fcm5

high2026-03-19

CVE-2026-33282-Ella Core panics on malformed NGAP Location Report

ellanetworks/core · GHSA-826q-wrq4-p23x

medium2026-03-19

CVE-2026-33281-Ella Core panics on invalid PDU Session IDs in NGAP messages

ellanetworks/core · GHSA-q669-4gmv-g8mf

high2026-03-19

CVE-2026-33310-Intake has a Command Injection via shell() Expansion in Parameter Defaults

intake/intake · GHSA-37g4-qqqv-7m99