Security advisories

low2026-03-12

Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties

sveltejs/devalue · GHSA-mwv9-gp5h-frr4

medium2026-03-12

CVE-2026-32234-Parse Server has a SQL injection via query field name when using PostgreSQL

parse-community/parse-server · GHSA-c442-97qw-j6c6

high2026-03-12

CVE-2026-32232-ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink

qhkm/zeptoclaw · GHSA-2m67-cxxq-c3h8

high2026-03-12

CVE-2026-32231-ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data

qhkm/zeptoclaw · GHSA-46q5-g3j9-wx5c

medium2026-03-12

CVE-2026-32237-@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

backstage/backstage · GHSA-8wq8-6859-qx77

low2026-03-12

CVE-2026-32236-@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

backstage/backstage · GHSA-qp4c-xg64-7c6x

medium2026-03-12

CVE-2026-32235-@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass

backstage/backstage · GHSA-wqvh-63mv-9w92

medium2026-03-12

kora-lib: Token-2022 Transfer Fee Not Deducted During Payment Verification

solana-foundation/kora · GHSA-725g-w329-g7qr

medium2026-03-12

kora-lib: Unrecognized Instruction Types Create Empty Stubs That Bypass Fee Payer Policy

solana-foundation/kora · GHSA-x442-m7cc-hr92

medium2026-03-12

CVE-2026-32106-StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

withstudiocms/studiocms · GHSA-wj56-g96r-673q

medium2026-03-12

CVE-2026-32104-StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings

withstudiocms/studiocms · GHSA-9v82-xrm4-mp52

medium2026-03-12

CVE-2026-32103-StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation

withstudiocms/studiocms · GHSA-h7vr-cg25-jf8c

high2026-03-12

CVE-2026-32101-StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check

withstudiocms/studiocms · GHSA-mm78-fgq8-6pgr

high2026-03-12

Traefik: HTTP/2 frames can cause a running server to panic

traefik/traefik · GHSA-4hjq-9h5c-252j

critical2026-03-12

CVE-2026-32136-AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass

adguardteam/adguardhome · GHSA-5fg6-wrq4-w5gh

medium2026-03-12

CVE-2026-32230-Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page

louislam/uptime-kuma · GHSA-c7hf-c5p5-5g6h

medium2026-03-12

CVE-2026-32112-ha-mcp has XSS via Unescaped HTML in OAuth Consent Form

homeassistant-ai/ha-mcp · GHSA-pf93-j98v-25pv

medium2026-03-12

CVE-2026-32111-ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

homeassistant-ai/ha-mcp · GHSA-fmfg-9g7c-3vq7

high2026-03-12

CVE-2026-32110-SiYuan has a Full-Read SSRF via /api/network/forwardProxy

siyuan-note/siyuan · GHSA-56cv-c5p2-j2wg

low2026-03-12

CVE-2026-32109-Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`

9001/copyparty · GHSA-rcp6-88mm-9vgf