Security advisories

medium2026-03-10

CVE-2026-29176-Craft Commerce has stored XSS in Inventory Location Name

craftcms/commerce · GHSA-wj89-2385-gpx3

high2026-03-10

CVE-2026-29175-Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking

craftcms/commerce · GHSA-cfpv-rmpf-f624

high2026-03-10

CVE-2026-29174-Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting

craftcms/commerce · GHSA-pmgj-gmm4-jh6j

low2026-03-10

CVE-2026-29173-Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table

craftcms/commerce · GHSA-mqxf-2998-c6cp

high2026-03-10

CVE-2026-29172-Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting

craftcms/commerce · GHSA-j3x5-mghf-xvfw

low2026-03-10

CVE-2026-29113-Craft CMS has a potential information disclosure vulnerability in preview tokens

craftcms/cms · GHSA-vg3j-hpm9-8v5v

high2026-03-10

CVE-2026-30944-StudioCMS has Privilege Escalation via Insecure API Token Generation

withstudiocms/studiocms · GHSA-667w-mmh7-mrr4

medium2026-03-10

CVE-2026-26310-Envoy vulnerable to crash for scoped ip address during DNS

envoyproxy/envoy · GHSA-3cw6-2j68-868p

medium2026-03-10

CVE-2026-1776-Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation

owen2345/camaleon-cms · GHSA-jw5g-f64p-6x78

medium2026-03-10

CVE-2026-30974-copyparty: volflag `nohtml` did not block javascript in svg files

9001/copyparty · GHSA-m6hv-x64c-27mm

medium2026-03-10

CVE-2026-30964-Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

web-auth/webauthn-framework · GHSA-f7pm-6hr8-7ggm

critical2026-03-10

CVE-2026-30960-RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface

apich-organization/rssn · GHSA-9c4h-pwmf-m6fj

critical2026-03-10

Linkdave Missing Authentication on REST and WebSocket endpoints

shi-gg/linkdave · GHSA-xv8g-fj9h-6gmv

medium2026-03-10

CVE-2026-30959-OneUptime has WhatsApp Resend Verification Authorization Bypass

oneuptime/oneuptime · GHSA-cw6x-mw64-q6pv

critical2026-03-10

CVE-2026-30957-OneUptime has Synthetic Monitor RCE via exposed Playwright browser object

oneuptime/oneuptime · GHSA-jw8q-gjvg-8w4q

critical2026-03-10

CVE-2026-30956-OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover

oneuptime/oneuptime · GHSA-r5v6-2599-9g3m

high2026-03-10

CVE-2026-30952-liquidjs has a path traversal fallback vulnerability

harttle/liquidjs · GHSA-wmfp-5q7x-987x

medium2026-03-10

CVE-2026-3089-Actual Sync Server has an Authenticated Path Traversal

actualbudget/actual · GHSA-27vg-33gh-4hwg

high2026-03-10

CVE-2026-30939-Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

parse-community/parse-server · GHSA-5j86-7r7m-p8h6

medium2026-03-10

CVE-2026-30938-Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement

parse-community/parse-server · GHSA-q342-9w2p-57fp