Security advisories

high2026-03-17

CVE-2026-4258-sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey

bitwiseshiftleft/sjcl · GHSA-2w8x-224x-785m

medium2026-03-16

CVE-2026-26304-Mattermost fails to verify run_create permission for empty playbookId

mattermost/mattermost-plugin-playbooks · GHSA-4pmx-622h-x359

high2026-03-16

CVE-2026-32813-Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)

admidio/admidio · GHSA-3x67-4c2c-w45m

medium2026-03-16

CVE-2026-32818-Admidio is Missing Authorization on Forum Topic and Post Deletion

admidio/admidio · GHSA-g375-5wmp-xr78

medium2026-03-16

CVE-2026-32757-Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection

admidio/admidio · GHSA-4wr4-f2qf-x5wj

critical2026-03-16

CVE-2026-32817-Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion

admidio/admidio · GHSA-rmpj-3x5m-9m5f

medium2026-03-16

CVE-2026-32812-Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint

admidio/admidio · GHSA-6j68-gcc3-mq73

medium2026-03-16

CVE-2026-32755-Admidio is Missing CSRF Protection on Role Membership Date Changes

admidio/admidio · GHSA-h8gr-qwr6-m9gx

medium2026-03-16

CVE-2026-32816-Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions

admidio/admidio · GHSA-wwg8-6ffr-h4q2

high2026-03-16

CVE-2026-32756-File Upload(RCE) Vulnerability in admidio

admidio/admidio · GHSA-95cq-p4w2-32w5

high2026-03-16

CVE-2026-32873-Loop with Unreachable Exit Condition ('Infinite Loop') in ewe

vshakitskiy/ewe · GHSA-4w98-xf39-23gp

medium2026-03-16

CVE-2026-32881-Permissive List of Allowed Inputs in ewe

vshakitskiy/ewe · GHSA-9w88-79f8-m3vp

high2026-03-16

CVE-2026-32829-lz4_flex's decompression can leak information from uninitialized memory or reused output buffer

pseitz/lz4_flex · GHSA-vvp9-7p8x-rfvv

medium2026-03-16

CVE-2026-32828-Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration

akuity/kargo · GHSA-j94x-8wcp-x7hm

high2026-03-16

CVE-2026-32769-Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace

ctfer-io/fullchain · GHSA-hxm7-9q36-c77f

high2026-03-16

CVE-2026-32805- Romeo is vulnerable to Archive Slip due to missing checks in sanitization

ctfer-io/romeo · GHSA-p799-g7vv-f279

high2026-03-16

CVE-2026-32771-Monitoring is vulnerable to Archive Slip due to missing checks in sanitization

ctfer-io/monitoring · GHSA-f7cq-gvh6-qr25

high2026-03-16

CVE-2026-32737-Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

ctfer-io/romeo · GHSA-fgm3-q9r5-43v9

high2026-03-16

CVE-2026-32768-Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

ctfer-io/chall-manager · GHSA-mw24-f3xh-j3qv

medium2026-03-16

CVE-2026-32758-File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter

filebrowser/filebrowser · GHSA-9f3r-2vgw-m8xp