Security advisories

medium2026-03-17

CVE-2026-33041-AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php

wwbn/avideo · GHSA-px7x-gq96-rmp5

high2026-03-17

CVE-2026-33038-AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments

wwbn/avideo · GHSA-2f9h-23f7-8gcx

medium2026-03-17

CVE-2026-33022-Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun

tektoncd/pipeline · GHSA-cv4x-93xx-wgfj

high2026-03-17

CVE-2026-33036-fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

naturalintelligence/fast-xml-parser · GHSA-8gc5-j5rx-235r

medium2026-03-17

CVE-2026-32953-Tillitis TKey Client has an Error in Protocol Implementation

tillitis/tkeyclient · GHSA-4w7r-3222-8h6v

high2026-03-17

CVE-2026-33012-Micronaut Framework vulnerable to a Denial of Service in HTML error response caching

micronaut-projects/micronaut-core · GHSA-2hcp-gjrf-7fhc

high2026-03-17

CVE-2026-33011-Nest Fastify HEAD Request Middleware Bypass

nestjs/nest · GHSA-wf42-42fg-fg84

medium2026-03-17

CVE-2026-32947-Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)

step-security/harden-runner · GHSA-46g3-37rh-v698

medium2026-03-17

CVE-2026-32946-Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)

step-security/harden-runner · GHSA-g699-3x6g-wm3g

medium2026-03-17

CVE-2026-32770-Parse Server LiveQuery subscription with invalid regular expression crashes server

parse-community/parse-server · GHSA-827p-g5x5-h86c

medium2026-03-17

CVE-2026-32742-Parse Server session creation endpoint allows overwriting server-generated session fields

parse-community/parse-server · GHSA-5v7g-9h8f-8pgg

medium2026-03-17

CVE-2026-32878-Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

parse-community/parse-server · GHSA-9ccr-fpp6-78qf

high2026-03-17

CVE-2026-32886-Parse Server's Cloud function dispatch crashes server via prototype chain traversal

parse-community/parse-server · GHSA-4263-jgmp-7pf4

medium2026-03-17

CVE-2026-32941-Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports

bishopfox/sliver · GHSA-97vp-pwqj-46qc

low2026-03-17

CVE-2026-32943-Parse Server has a password reset token single-use bypass via concurrent requests

parse-community/parse-server · GHSA-r3xq-68wh-gwvh

high2026-03-17

CVE-2026-32944-Parse Server crash via deeply nested query condition operators

parse-community/parse-server · GHSA-9xp9-j92r-p88v

medium2026-03-17

CVE-2026-32700-Devise has a confirmable "change email" race condition permits user to confirm email they have no access to

heartcombo/devise · GHSA-57hq-95w6-v4fc

medium2026-03-17

CVE-2026-32636-ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

imagemagick/imagemagick · GHSA-gc62-2v5p-qpmp

high2026-03-17

CVE-2026-32254-Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS

cloudnativelabs/kube-router · GHSA-phqm-jgc3-qf8g

critical2026-03-17

CVE-2026-31938-jsPDF has HTML Injection in New Window paths

parallax/jspdf · GHSA-wfv2-pwc8-crg5