Security advisories

high2026-03-19

CVE-2026-33210-Ruby JSON has a format string injection vulnerability

ruby/json · GHSA-3m6g-2423-7cp3

medium2026-03-19

CVE-2026-33319-AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

wwbn/avideo · GHSA-w5ff-2mjc-4phc

high2026-03-19

CVE-2026-33241-Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing

salvo-rs/salvo · GHSA-pp9r-xg4c-8j4x

high2026-03-19

CVE-2026-33242-Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass

salvo-rs/salvo · GHSA-f842-phm9-p4v4

high2026-03-19

Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

modelcontextprotocol/go-sdk · GHSA-q382-vc8q-7jhj

medium2026-03-19

CVE-2026-33238-AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration

wwbn/avideo · GHSA-4wmm-6qxj-fpj4

medium2026-03-19

CVE-2026-33237-AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation

wwbn/avideo · GHSA-v467-g7g7-hhfh

medium2026-03-19

CVE-2026-32691-Juju affected by timing ownership claim attack on new external back-end secrets

juju/juju · GHSA-gfgr-6hrj-85ww

high2026-03-19

CVE-2026-33236-NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

nltk/nltk · GHSA-469j-vmhf-r6v7

high2026-03-19

CVE-2026-33231-Unauthenticated remote shutdown in nltk.app.wordnet_app

nltk/nltk · GHSA-jm6w-m3j8-898g

high2026-03-19

CVE-2026-33068-Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

anthropics/claude-code · GHSA-mmgp-wc2j-qcv7

high2026-03-19

CVE-2025-15031-Arbitrary file write via tar traversal in mlflow

mlflow/mlflow · GHSA-fhff-qmm8-h2fp

medium2026-03-18

CVE-2026-33230-Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk

nltk/nltk · GHSA-gfwx-w7gr-fvh7

high2026-03-18

CVE-2026-33226-Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

budibase/budibase · GHSA-4647-wpjq-hh7f

low2026-03-18

CVE-2026-33221-Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload

nhost/nhost · GHSA-g9f6-9775-hffm

critical2026-03-18

CVE-2026-33211-Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod

tektoncd/pipeline · GHSA-j5q5-j9gm-2w5c

medium2026-03-18

JustHTML has a Sanitizer Bypass (in Markdown)

emilstenstrom/justhtml · GHSA-3rcm-vjrc-p45j

medium2026-03-18

JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)

emilstenstrom/justhtml · GHSA-qvc2-mg72-jjhx

high2026-03-18

Unsigned SAML LogoutRequest Acceptance in gosaml2

russellhaering/gosaml2 · GHSA-pcgw-qcv5-h8ch

high2026-03-18

gosaml2 CBC Padding Panic — Unauthenticated Process Crash

russellhaering/gosaml2 · GHSA-hwqm-qvj9-4jr2