Security advisories

high2026-03-16

CVE-2026-32264-Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

craftcms/cms · GHSA-4484-8v2f-5748

high2026-03-16

CVE-2026-32263-Craft CMS vulnerable to behavior injection RCE via EntryTypesController

craftcms/cms · GHSA-qx2q-q59v-wf3j

medium2026-03-16

CVE-2026-32262-Craft CMS has a Path Traversal Vulnerability in AssetsController

craftcms/cms · GHSA-472v-j2g4-g9h2

high2026-03-16

CVE-2026-32261-RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin

craftcms/webhooks · GHSA-8wg7-wm29-2rvg

medium2026-03-16

CVE-2026-32723-SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers

nyariv/sandboxjs · GHSA-7p5m-xrh7-769r

low2026-03-16

CVE-2026-32722-Stored XSS in Memray-generated HTML reports via unescaped command-line metadata

bloomberg/memray · GHSA-r5pr-887v-m2w9

low2026-03-16

CVE-2026-32732-XSS in @leanprover/unicode-input-component

leanprover/vscode-lean4 · GHSA-6ggm-pwr9-r5h2

low2026-03-16

CVE-2026-32638-StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens

withstudiocms/studiocms · GHSA-xvf4-ch4q-2m24

high2026-03-16

CVE-2026-32634-Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

nicolargo/glances · GHSA-vx5f-957p-qpvm

critical2026-03-16

CVE-2026-32633-Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`

nicolargo/glances · GHSA-r297-p3v4-wp8m

medium2026-03-16

CVE-2026-32632-Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding

nicolargo/glances · GHSA-hhcg-r27j-fhv9

high2026-03-16

CVE-2026-32611-Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements

nicolargo/glances · GHSA-49g7-2ww7-3vf5

high2026-03-16

CVE-2026-32610-Glances's Default CORS Configuration Allows Cross-Origin Credential Theft

nicolargo/glances · GHSA-9jfm-9rc6-2hfq

high2026-03-16

CVE-2026-32609-Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials

nicolargo/glances · GHSA-cvwp-r2g2-j824

high2026-03-16

CVE-2026-32608-Glances has a Command Injection via Process Names in Action Command Templates

nicolargo/glances · GHSA-vcv2-q258-wrg7

high2026-03-16

CVE-2026-32606-IncusOS has a LUKS encryption bypass due to insufficient TPM policy

lxc/incus-os · GHSA-wj2j-qwcf-cfcc

high2026-03-16

CVE-2026-32596-Glances exposes the REST API without authentication

nicolargo/glances · GHSA-wvxv-4j8q-4wjq

high2026-03-16

CVE-2026-28500-ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

onnx/onnx · GHSA-hqmj-h5c6-369m

medium2026-03-16

CVE-2026-28499-LeafKit's HTML escaping may be skipped for Collection values, enabling XSS

vapor/leaf-kit · GHSA-6jj5-j4j8-8473

high2026-03-16

CVE-2026-27459-pyOpenSSL DTLS cookie callback buffer overflow

pyca/pyopenssl · GHSA-5pwr-322w-8jr4