Security advisories

high2026-03-10

CVE-2026-30925-Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery

parse-community/parse-server · GHSA-mf3j-86qx-cq5j

medium2026-03-10

CVE-2026-30913-flarum/nicknames extension has display name injection in notification emails (autolink & markdown)

flarum/framework · GHSA-3c4m-j3g4-hh25

high2026-03-09

CVE-2026-0846-NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

nltk/nltk · GHSA-h8wq-7xc4-p3qx

medium2026-03-09

CVE-2026-25960-vLLM has SSRF Protection Bypass

vllm-project/vllm · GHSA-v359-jj2v-j536

high2026-03-09

AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs

azuracast/azuracast · GHSA-93fx-5qgc-wr38

medium2026-03-09

CVE-2026-27646-OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions

openclaw/openclaw · GHSA-9q36-67vc-rrwg

medium2026-03-09

OpenClaw: system.run allow-always persistence included shell-commented payload tails

openclaw/openclaw · GHSA-9q2p-vc84-2rwm

medium2026-03-09

OpenClaw: `operator.write` chat.send could reach admin-only config writes

openclaw/openclaw · GHSA-hfpr-jhpq-x4rm

low2026-03-09

CVE-2026-27183-OpenClaw: system.run wrapper-depth boundary could skip shell approval gating

openclaw/openclaw · GHSA-r6qf-8968-wj9q

high2026-03-09

CVE-2026-32913-OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects

openclaw/openclaw · GHSA-6mgf-v5j7-45cr

medium2026-03-09

OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping

openclaw/openclaw · GHSA-pjvx-rx66-r3fg

medium2026-03-09

OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers

openclaw/openclaw · GHSA-3h2q-j2v4-6w5r

medium2026-03-09

OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots

openclaw/openclaw · GHSA-j425-whc4-4jgc

medium2026-03-09

OpenClaw's hooks count non-POST requests toward auth lockout

openclaw/openclaw · GHSA-6rmx-gvvg-vh6j

high2026-03-09

OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

openclaw/openclaw · GHSA-rchv-x836-w7xp

high2026-03-09

CVE-2026-30930-Glances has SQL Injection via Process Names in TimescaleDB Export

nicolargo/glances · GHSA-x46r-mf5g-xpr6

high2026-03-09

CVE-2026-30928-Glances Exposes Unauthenticated Configuration Secrets

nicolargo/glances · GHSA-gh4x-f7cq-wwx6

high2026-03-09

CVE-2026-30934-FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)

gtsteffaniak/filebrowser · GHSA-r633-fcgp-m532

high2026-03-09

CVE-2026-30933-FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info

gtsteffaniak/filebrowser · GHSA-525j-95gf-766f

medium2026-03-09

CVE-2026-30927-Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter

admidio/admidio · GHSA-7pfv-hr63-h7cw