Security advisories

medium2026-03-11

CVE-2026-31825-Sylius has a DQL Injection via API Order Filters

sylius/sylius · GHSA-xcwx-r2gw-w93m

high2026-03-11

CVE-2026-31824-Sylius has a Promotion Usage Limit Bypass via Race Condition

sylius/sylius · GHSA-7mp4-25j8-hp5q

medium2026-03-11

CVE-2026-31823-Sylius Vulnerable to Authenticated Stored XSS

sylius/sylius · GHSA-mx4q-xxc9-pf5q

medium2026-03-11

CVE-2026-31822-Sylius has a XSS vulnerability in checkout login form

sylius/sylius · GHSA-vgh8-c6fp-7gcg

medium2026-03-11

CVE-2026-31821-Sylius is Missing Authorization in API v2 Add Item Endpoint

sylius/sylius · GHSA-wjmg-4cq5-m8hg

high2026-03-11

CVE-2026-31820-Sylius affected by IDOR in Cart and Checkout LiveComponents

sylius/sylius · GHSA-2xc6-348p-c2x6

medium2026-03-11

CVE-2026-31819-Sylius has an Open Redirect via Referer Header

sylius/sylius · GHSA-9ffx-f77r-756w

high2026-03-11

CVE-2026-28807-Wisp Vulnerable to Path Traversal

gleam-wisp/wisp · GHSA-h7cj-j2vv-qw8r

medium2026-03-11

CVE-2026-31815-django-unicorn affected by component state manipulation via unvalidated attribute access

django-commons/django-unicorn · GHSA-ffv6-jj46-x367

high2026-03-11

CVE-2026-31817-OliveTin's unsafe parsing of UniqueTrackingId can be used to write files

olivetin/olivetin · GHSA-364q-w7vh-vhpc

high2026-03-11

CVE-2026-31812-Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

quinn-rs/quinn · GHSA-6xvm-j4wr-6v98

medium2026-03-10

CVE-2026-31809-SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS

siyuan-note/siyuan · GHSA-pmc9-f5qr-2pcr

high2026-03-10

CVE-2026-31861-@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes

siteboon/claudecodeui · GHSA-7fv4-fmmc-86g2

medium2026-03-10

CVE-2026-31808-file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header

sindresorhus/file-type · GHSA-5v7r-6r5c-r473

medium2026-03-10

CVE-2026-31807-SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS

siyuan-note/siyuan · GHSA-5hc8-qmg8-pw27

high2026-03-10

CVE-2026-31802-node-tar Symlink Path Traversal via Drive-Relative Linkpath

isaacs/node-tar · GHSA-9ppj-qmqm-q256

high2026-03-10

CVE-2026-31801-zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required)

project-zot/zot · GHSA-85jx-fm8m-x8c6

high2026-03-10

CVE-2026-26801-pdfmake is vulnerable to server-side request forgery (SSRF)

bpampuch/pdfmake · GHSA-wp52-r2fp-4vmr

medium2026-03-10

CVE-2026-31853-ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

imagemagick/imagemagick · GHSA-56jp-jfqg-f8f4

medium2026-03-10

CVE-2026-30883-ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

imagemagick/imagemagick · GHSA-qmw5-2p58-xvrc