Security advisories

medium2026-03-18

CVE-2026-33171-Statamic has a path traversal in file dictionary fieldtype

statamic/cms · GHSA-qm7r-wwq7-6f85

high2026-03-18

CVE-2026-33172-Statamic has Stored XSS via SVG Sanitization Bypass

statamic/cms · GHSA-7rcv-55mj-chg7

high2026-03-18

CVE-2026-33040-Gossipsub PRUNE.backoff Duration Overflow

libp2p/rust-libp2p · GHSA-gc42-3jg7-rxr2

high2026-03-18

CVE-2026-33166-Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)

allure-framework/allure2 · GHSA-64hm-gfwq-jppw

high2026-03-18

CVE-2026-33163-Parse Server leaks protected fields via LiveQuery afterEvent trigger

parse-community/parse-server · GHSA-5hmj-jcgp-6hff

critical2026-03-18

CVE-2026-32731-ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction

apostrophecms/apostrophe · GHSA-mwxc-m426-3f78

high2026-03-18

CVE-2026-32730-ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

apostrophecms/apostrophe · GHSA-v9xm-ffx2-7h35

high2026-03-18

CVE-2026-33001-Jenkins has a link following vulnerability allows arbitrary file creation

jenkinsci/jenkins · GHSA-r6qv-frpc-q66c

medium2026-03-18

CVE-2026-33003-Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files

jenkinsci/loadninja-plugin · GHSA-qqjr-hf5h-jx3q

high2026-03-18

CVE-2026-33002-Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation

jenkinsci/jenkins · GHSA-phhv-63fh-rrc8

medium2026-03-18

CVE-2026-33004-Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form

jenkinsci/loadninja-plugin · GHSA-p9hg-wrmv-v8cp

medium2026-03-18

CVE-2026-33209-Avo has a XSS vulnerability on `return_to` param

avo-hq/avo · GHSA-762r-27w2-q22j

low2026-03-18

Improper detection of disallowed URIs by Loofah `allowed_uri?`

flavorjones/loofah · GHSA-46fp-8f5p-pf2m

high2026-03-18

CVE-2026-32937-Out-of-Bounds Slice Access in free5GC CHF Leading to DoS

free5gc/chf · GHSA-6g43-577r-wf4x

high2026-03-18

CVE-2026-33151-socket.io allows an unbounded number of binary attachments

socketio/socket.io · GHSA-677m-j7p3-52f9

medium2026-03-18

CVE-2026-33132-Zitadel is missing enforcement of organization scopes

zitadel/zitadel · GHSA-g2pf-ww5m-2r9m

high2026-03-18

CVE-2026-33143-OneUptime WhatsApp Webhook Missing Signature Verification

oneuptime/oneuptime · GHSA-g5ph-f57v-mwjc

high2026-03-18

CVE-2026-33142-OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

oneuptime/oneuptime · GHSA-gcg3-c5p2-cqgg

medium2026-03-18

CVE-2026-33081-PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation

pinchtab/pinchtab · GHSA-qwxp-6qf9-wr4m

medium2026-03-18

CVE-2026-33140-Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution

parzivalhack/pyspector · GHSA-2gmv-2r3v-jxj2