Security advisories

high2026-03-13

CVE-2026-1528-Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

nodejs/undici · GHSA-f269-vfmq-vjvj

medium2026-03-13

CVE-2026-1525-Undici has an HTTP Request/Response Smuggling issue

nodejs/undici · GHSA-2mjp-6q6p-2qxm

medium2026-03-13

CVE-2026-32598-OneUptime: Password Reset Token Logged at INFO Level

oneuptime/oneuptime · GHSA-4524-cj9j-g4fj

high2026-03-13

CVE-2026-32597-PyJWT accepts unknown `crit` header extensions

jpadilla/pyjwt · GHSA-752w-5fwx-jx9f

medium2026-03-13

CVE-2026-32594-Parse Server's GraphQL WebSocket endpoint bypasses security middleware

parse-community/parse-server · GHSA-p2x3-8689-cwpg

high2026-03-13

CVE-2026-32314-Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145

libp2p/rust-yamux · GHSA-vxx9-2994-q338

high2026-03-13

CVE-2026-32313-xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption

robrichards/xmlseclibs · GHSA-4v26-v6cg-g6f9

critical2026-03-13

CVE-2026-32301-Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

centrifugal/centrifugo · GHSA-j77h-rr39-c552

high2026-03-13

CVE-2026-105782-Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware

scrapy/scrapy · GHSA-cwxj-rr6w-m6w7

medium2026-03-13

CVE-2026-32269-Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

parse-community/parse-server · GHSA-69xg-f649-w5g2

high2026-03-13

CVE-2026-32260-Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process

denoland/deno · GHSA-4c96-w8v2-p28j

medium2026-03-13

CVE-2026-32322-rs-soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction

stellar/rs-soroban-sdk · GHSA-x2hw-px52-wp4m

high2026-03-13

CVE-2026-32308-OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")

oneuptime/oneuptime · GHSA-wvh5-6vjm-23qh

critical2026-03-13

CVE-2026-32306- OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

oneuptime/oneuptime · GHSA-p5g2-jm85-8g35

medium2026-03-13

OpenClaw: Discord guild reaction ingress could bypass users and roles allowlists

openclaw/openclaw · GHSA-9vvh-2768-c8vp

high2026-03-13

CVE-2026-31899-CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

kozea/cairosvg · GHSA-f38f-5xpm-9r7c

high2026-03-13

CVE-2026-31814-Yamux vulnerable to remote Panic via malformed WindowUpdate credit

libp2p/rust-yamux · GHSA-4w32-2493-32g7

medium2026-03-13

CVE-2026-30961-Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload

forceu/gokapi · GHSA-45vh-rpc8-hxpp

medium2026-03-13

CVE-2026-30955-Gokapi vulnerable to DoS in E2E Metadata Parser

forceu/gokapi · GHSA-qwc6-vc2v-2ggj

medium2026-03-13

CVE-2026-30943-Gokapi vulnerable to Privilege Escalation in File Replace

forceu/gokapi · GHSA-j6jp-78w8-34x6