Security advisories

critical2026-03-19

CVE-2026-33309-Langflow has an Arbitrary File Write (RCE) via v2 API

langflow-ai/langflow · GHSA-g2j9-7rj2-gm6c

high2026-03-19

CVE-2026-33228-Prototype Pollution via parse() in NodeJS flatted

webreflection/flatted · GHSA-rf6f-7fwh-wjgh

medium2026-03-19

CVE-2026-32694-Juju affected by Confused Deputy IDOR attack via Predictable user specified ID in Juju Secrets

juju/juju · GHSA-5cj2-rqqf-hx9p

high2026-03-19

CVE-2026-32693-Juju has unauthorized access to out-of-scope Kubernetes secrets

juju/juju · GHSA-439w-v2p7-pggc

high2026-03-19

CVE-2026-32692-Juju has unauthorized update of out-of-scope Vault secrets

juju/juju · GHSA-89x7-5m5m-mcmm

medium2026-03-19

CVE-2026-32889-Denial of service via non-terminating SYLT frame parsing loop in tinytag

tinytag/tinytag · GHSA-f4rq-2259-hv29

medium2026-03-19

CVE-2026-33297-AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php

wwbn/avideo · GHSA-6547-8hrg-c55m

low2026-03-19

CVE-2026-33296-AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php

wwbn/avideo · GHSA-hj5h-5623-gwhw

high2026-03-19

CVE-2026-33295-AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php

wwbn/avideo · GHSA-gc3m-4mcr-h3pv

medium2026-03-19

CVE-2026-33294-AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources

wwbn/avideo · GHSA-66cw-h2mj-j39p

high2026-03-19

CVE-2026-33293-AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter

wwbn/avideo · GHSA-xmjm-86qv-g226

high2026-03-19

CVE-2026-33292-AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos

wwbn/avideo · GHSA-pw4v-x838-w5pg

high2026-03-19

CVE-2026-33252-Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

modelcontextprotocol/go-sdk · GHSA-89xv-2j6f-qhc8

high2026-03-19

CVE-2026-32935-phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack

phpseclib/phpseclib · GHSA-94g3-g5v7-q4jg

critical2026-03-19

CVE-2026-30924-qui CORS Misconfiguration: Arbitrary Origins Trusted

autobrr/qui · GHSA-h8vw-ph9r-xpch

critical2026-03-19

CVE-2026-30836-step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)

smallstep/certificates · GHSA-q4r8-xm5f-56gw

high2026-03-19

CVE-2026-27953-ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor

ormar-orm/ormar · GHSA-f964-whrq-44h8

critical2026-03-19

MCP Connect has unauthenticated remote OS command execution via /bridge endpoint

evalsone/mcp-connect · GHSA-wvr4-3wq4-gpc5

medium2026-03-19

CVE-2026-33320-Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service

tomwright/dasel · GHSA-4fcp-jxh7-23x8

medium2026-03-19

CVE-2026-56346-AVideo has Unauthenticated PGP Message Decryption via Public Endpoint

wwbn/avideo · GHSA-5x2w-37xf-7962