Security advisories

high2026-03-18

CVE-2026-33487-validateSignature Loop Variable Capture Signature Bypass in goxmldsig

russellhaering/goxmldsig · GHSA-479m-364c-43vc

medium2026-03-18

CVE-2026-66393-Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

nltk/nltk · GHSA-rf74-v2fm-23pw

low2026-03-18

mo has a XSS via inline SVG script tags in Markdown rendering

k1low/mo · GHSA-vccx-p757-pv6h

high2026-03-18

CVE-2026-33204-SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering

kelvinmo/simplejwt · GHSA-xw36-67f8-339x

high2026-03-18

CVE-2026-33192-free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques

free5gc/udm · GHSA-5rvc-5cwx-g5x8

high2026-03-18

CVE-2026-33191-free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error

free5gc/udm · GHSA-p9hg-pq3q-v9gv

high2026-03-18

CVE-2026-33203-SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass

siyuan-note/siyuan · GHSA-3g9h-9hp4-654v

medium2026-03-18

CVE-2026-33194-SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)

siyuan-note/siyuan · GHSA-vm69-h85x-8p85

critical2026-03-18

CVE-2026-33186-gRPC-Go has an authorization bypass via missing leading slash in :path

grpc/grpc-go · GHSA-p77j-4mvh-x3m3

high2026-03-18

CVE-2026-33155-DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT

seperman/deepdiff · GHSA-54jj-px8x-5w5q

high2026-03-18

CVE-2026-33154-dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

dynaconf/dynaconf · GHSA-pxrr-hq57-q35p

critical2026-03-18

CVE-2026-33180-HAPI FHIR HTTP authentication leak in redirects

hapifhir/org.hl7.fhir.core · GHSA-p7m9-v2cm-2h7m

high2026-03-18

CVE-2026-33080-Filament Unvalidated Range and Values summarizer values can be used for XSS

filamentphp/filament · GHSA-vv3x-j2x5-36jc

medium2026-03-18

CVE-2026-33065-free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request

free5gc/free5gc · GHSA-958m-gxmc-mccm

high2026-03-18

CVE-2026-33064-free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference

free5gc/udm · GHSA-7g27-v5wj-jr75

high2026-03-18

CVE-2026-33063-free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion

free5gc/free5gc · GHSA-4jrw-92fg-4jwx

high2026-03-18

CVE-2026-33062-free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter

free5gc/free5gc · GHSA-7c47-xr7q-p6hg

critical2026-03-18

CVE-2026-33057-Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py

mesop-dev/mesop · GHSA-gjgx-rvqr-6w6v

critical2026-03-18

CVE-2026-33054-Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion

mesop-dev/mesop · GHSA-8qvf-mr4w-9x2c

medium2026-03-18

CVE-2026-33177-Statamic is missing authorization check on taxonomy term creation via fieldtype

statamic/cms · GHSA-wh3h-gvc4-cc2g