Security advisories

low2026-03-12

CVE-2026-3965-@whyour/qinglong: manipulation of the argument command leads to protection mechanism failure

whyour/qinglong · GHSA-xj37-qjg2-xwv2

medium2026-03-12

CVE-2026-31988-yauzl contains an off-by-one error

thejoshwolfe/yauzl · GHSA-gmq8-994r-jv83

medium2026-03-12

CVE-2026-2808-Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication

hashicorp/consul · GHSA-cpfq-66p2-336j

critical2026-03-11

CVE-2026-31976-xygeni-action v5 tag poisoned with C2 backdoor

xygeni/xygeni-action · GHSA-f8q5-h5qh-33mh

medium2026-03-11

Tornado has incomplete validation of cookie attributes

tornadoweb/tornado · GHSA-78cv-mqj4-43f7

high2026-03-11

CVE-2026-26127-.NET Denial of Service Vulnerability

dotnet/runtime · GHSA-73j8-2gch-69rq

high2026-03-11

CVE-2026-26130-.NET Denial of Service Vulnerability

dotnet/aspnetcore · GHSA-4vgm-c2wm-63mw

medium2026-03-11

CVE-2026-32094-Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash

ericcornelissen/shescape · GHSA-9jfh-9xrq-4vwm

high2026-03-11

CVE-2026-26131-.NET Elevation of Privilege Vulnerability

dotnet/runtime · GHSA-crjq-wm6x-6qx7

high2026-03-11

CVE-2026-31892-Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

argoproj/argo-workflows · GHSA-3wf5-g532-rcrr

high2026-03-11

CVE-2026-31889-Shopware vulnerable to a potential take over of app credentials

shopware/shopware · GHSA-c4p7-rwrg-pf6p

medium2026-03-11

CVE-2026-31888-Shopware has user enumeration via distinct error codes on Store API login endpoint

shopware/shopware · GHSA-gqc5-xv7m-gcjq

high2026-03-11

CVE-2026-31887-Shopware: Unauthenticated data extraction possible through store-api.order endpoint

shopware/shopware · GHSA-7vvp-j573-5584

medium2026-03-11

CVE-2026-3429-Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API

keycloak/keycloak · GHSA-8g9r-9wjw-37j4

low2026-03-11

CVE-2026-31863-Anytype Heart's gRPC API client challenge verification can be bypassed on localhost

anyproto/anytype-heart · GHSA-vv3h-7qwr-722v

low2026-03-11

CVE-2026-56381-Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page

craftcms/cms · GHSA-g3hp-vvqf-8vw6

high2026-03-11

CVE-2026-31857-CraftCMS has an RCE vulnerability via relational conditionals in the control panel

craftcms/cms · GHSA-fp5j-j7j4-mcxc

high2026-03-11

CVE-2026-31839-Striae has a hash validation utility vulnerability

striae-org/striae · GHSA-mmf8-487q-p45m

high2026-03-11

CVE-2026-31834-Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

umbraco/umbraco-cms · GHSA-rhcg-3h8r-v6vp

medium2026-03-11

CVE-2026-31833-Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

umbraco/umbraco-cms · GHSA-vrqc-59mw-qqg7