Security advisories

critical2026-03-11

Cosmos EVM: incorrect state handling during nested EVM execution paths

cosmos/evm · GHSA-54gx-3cgr-7mfm

medium2026-03-11

CVE-2026-29777-Traefik: kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values

traefik/traefik · GHSA-8q2w-wr49-whqj

high2026-03-11

CVE-2026-28229-Unauthorized access to Argo Workflows Template

argoproj/argo-workflows · GHSA-56px-hm34-xqj5

low2026-03-11

CVE-2026-3911-Keycloak: Information disclosure of disabled user attributes via administrative endpoint

keycloak/keycloak · GHSA-xh32-c9wx-phrp

medium2026-03-11

CVE-2026-31960-Quill has DoS via unbounded read of HTTP response body during notarization

anchore/quill · GHSA-g32c-4pvp-769g

medium2026-03-11

CVE-2026-31961-Quill has unbounded memory allocation via unvalidated size fields in Mach-O binary parsing

anchore/quill · GHSA-xj69-m9qq-8m94

medium2026-03-11

CVE-2026-31959-Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval

anchore/quill · GHSA-7q3q-5px6-4c5p

high2026-03-11

CVE-2026-31975-@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection

siteboon/claudecodeui · GHSA-gv8f-wpm2-m5wr

medium2026-03-11

CVE-2026-31901-Parse Server vulnerable to user enumeration via email verification endpoint

parse-community/parse-server · GHSA-w54v-hf9p-8856

high2026-03-11

CVE-2026-31875-Parse Server's MFA recovery codes not consumed after use

parse-community/parse-server · GHSA-4hf6-3x24-c9m8

high2026-03-11

CVE-2026-31872-Parse Server has a protected fields bypass via dot-notation in query and sort

parse-community/parse-server · GHSA-r2m8-pxm9-9c4g

critical2026-03-11

CVE-2026-31871-Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

parse-community/parse-server · GHSA-gqpp-xgvh-9h7h

medium2026-03-11

CVE-2026-31868-Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types

parse-community/parse-server · GHSA-v5hf-f4c3-m5rv

high2026-03-11

CVE-2026-31866-flagd Vulnerable to Allocation of Resources Without Limits or Throttling

open-feature/flagd · GHSA-rmrf-g9r3-73pm

critical2026-03-11

Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go

arslanbekov/terraform-provider-sendgrid · GHSA-j443-wcqq-xprh

medium2026-03-11

CVE-2026-56763-Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })

honojs/hono · GHSA-v8w9-8mx6-g223

medium2026-03-11

actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects

robjtede/actix-web-lab · GHSA-vhj5-x93p-67jw

high2026-03-11

CVE-2026-31858-CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

craftcms/cms · GHSA-g7j6-fmwx-7vp8

critical2026-03-11

CVE-2026-31856-Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL

parse-community/parse-server · GHSA-q3vj-96h2-gwvg

medium2026-03-11

CVE-2026-31859-CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization

craftcms/cms · GHSA-fvwq-45qv-xvhv