Security advisories

critical2026-03-13

CVE-2026-26954-SandboxJS affected by a Sandbox Escape

nyariv/sandboxjs · GHSA-6r9f-759j-hjgv

medium2026-03-12

CVE-2026-32320-Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings

ellanetworks/core · GHSA-j478-p7vq-3347

high2026-03-12

CVE-2026-32319-Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload

ellanetworks/core · GHSA-m9pm-w3gv-c68f

high2026-03-12

CVE-2026-32302-OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode

openclaw/openclaw · GHSA-5wcw-8jjv-m286

medium2026-03-12

CVE-2026-29066-TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction

tinacms/tinacms · GHSA-m48g-4wr2-j2h6

high2026-03-12

CVE-2026-28793-TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete

tinacms/tinacms · GHSA-2f24-mg4x-534q

critical2026-03-12

CVE-2026-28792-TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

tinacms/tinacms · GHSA-8pw3-9m7f-q734

medium2026-03-12

CVE-2023-1289-ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS

imagemagick/imagemagick · GHSA-j96m-mjp6-99xr

high2026-03-12

CVE-2026-32274-Black: Arbitrary file writes from unsanitized user input in cache file name

psf/black · GHSA-3936-cmfr-pm3m

medium2026-03-12

CVE-2026-31841-Hyperterse: Raw exposure of database statements in MCP search tool

hyperterse/hyperterse · GHSA-92gp-jfgx-9qpv

high2026-03-12

CVE-2026-28791-Tina: Path Traversal in Media Upload Handle

tinacms/tinacms · GHSA-5hxf-c7j4-279c

high2026-03-12

CVE-2026-28356-multipart vulnerable to ReDoS in `parse_options_header()`

defnull/multipart · GHSA-p2m9-wcp5-6qw3

medium2026-03-12

CVE-2026-24125-@tinacms/graphql has a Path Traversal issue

tinacms/tinacms · GHSA-2238-xc5r-v9hj

critical2026-03-12

CVE-2026-32248-Parse Server: Account takeover via operator injection in authentication data identifier

parse-community/parse-server · GHSA-5fw2-8jcv-xh87

critical2026-03-12

CVE-2026-32242-Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance

parse-community/parse-server · GHSA-2cjm-2gwv-m892

medium2026-03-12

CVE-2026-73426-Trix has a Stored XSS vulnerability through serialized attributes

basecamp/trix · GHSA-qmpg-8xg6-ph5q

high2026-03-12

CVE-2026-32247-Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters

getzep/graphiti · GHSA-gg5m-55jj-8m5g

high2026-03-12

CVE-2026-32246-Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

steveiliop56/tinyauth · GHSA-3q28-qjrv-qr39

medium2026-03-12

CVE-2026-32245-Tinyauth's OIDC authorization codes are not bound to client on token exchange

steveiliop56/tinyauth · GHSA-xg2q-62g2-cvcm

medium2026-03-12

ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation

qhkm/zeptoclaw · GHSA-4cm8-xpfv-jv6f