Security advisories

high2026-03-18

CVE-2026-33139-PySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution

parzivalhack/pyspector · GHSA-v3xv-8vc3-h2m6

medium2026-03-18

h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read

h3js/h3 · GHSA-wr4h-v87w-p3r7

high2026-03-18

CVE-2026-33131-h3 has a middleware bypass with one gadget

h3js/h3 · GHSA-3vj8-jmxq-cgj5

medium2026-03-18

CVE-2026-33129-h3 has an observable timing discrepancy in basic auth utils

h3js/h3 · GHSA-26f5-8h2x-34xh

high2026-03-18

CVE-2026-33128-h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

h3js/h3 · GHSA-22cc-p3c6-wpvm

medium2026-03-18

CVE-2026-33123-pypdf has inefficient decoding of array-based streams

py-pdf/pypdf · GHSA-qpxp-75px-xjcp

medium2026-03-18

CVE-2026-1323-The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

cps-it/mailqueue · GHSA-2pm6-9fhx-vvg3

medium2026-03-18

Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas

pdfme/pdfme · GHSA-87v3-4cfp-cm76

medium2026-03-18

Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas

pdfme/pdfme · GHSA-qq9g-96v4-m3cj

high2026-03-18

Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)

cap-go/capgo · GHSA-8mpm-q7mh-8fvh

medium2026-03-18

CVE-2026-33067-SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

siyuan-note/siyuan · GHSA-mvpm-v6q4-m2pf

medium2026-03-18

CVE-2026-33066-SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering

siyuan-note/siyuan · GHSA-4663-4mpg-879v

high2026-03-18

CVE-2026-33125-Frigte has broken access control viewer user can delete admin and other users account

blakeblackshear/frigate · GHSA-vg28-83rp-8xx4

high2026-03-18

CVE-2026-32875-UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

ultrajson/ultrajson · GHSA-c8rr-9gxc-jprv

high2026-03-18

CVE-2026-32874-UltraJSON has a Memory Leak parsing large integers allows DoS

ultrajson/ultrajson · GHSA-wgvc-ghv9-3pmm

high2026-03-18

CVE-2026-32811-Heimdall: Path received via Envoy gRPC corrupted when containing query string

dadrus/heimdall · GHSA-r8x2-fhmf-6mxp

high2026-03-18

CVE-2026-32286-Denial of service in github.com/jackc/pgproto3/v2

jackc/pgproto3 · GHSA-jqcq-xjh3-6g23

high2026-03-18

CVE-2026-32285-github.com/buger/jsonparser has a denial of service vulnerability

buger/jsonparser · GHSA-6g7g-w4f8-9c9x

high2026-03-18

CVE-2026-32284-Denial of service in github.com/shamaton/msgpack

shamaton/msgpack · GHSA-h9q6-hc68-35rp

medium2026-03-18

CVE-2026-33060-SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks

ondata/ckan-mcp-server · GHSA-3xm7-qw7j-qc8v