Security advisories

low2026-03-07

Soroban: Muxed address<->ScVal conversions may break after a conversion failure

stellar/rs-soroban-env · GHSA-pm4j-7r4q-ccg8

critical2026-03-07

CVE-2026-30921-OneUptime: Synthetic Monitor RCE via exposed Playwright browser object

oneuptime/oneuptime · GHSA-4j36-39gm-8vq8

high2026-03-07

x402 SDK Security Advisory

coinbase/x402 · GHSA-qr2g-p6q7-w82m

high2026-03-07

CVE-2026-31900-Black's vulnerable version parsing leads to RCE in GitHub Action

psf/black · GHSA-v53h-f6m7-xcgm

high2026-03-07

CVE-2025-69971-FUXA has a hardcoded fallback JWT signing secret

frangoteam/fuxa · GHSA-c8m8-3jcr-6rj5

critical2026-03-07

CVE-2026-30887-OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

oneuptime/oneuptime · GHSA-h343-gg57-2q67

medium2026-03-07

CVE-2026-30885-AVideo has Unauthenticated IDOR - Playlist Information Disclosure

wwbn/avideo · GHSA-6w2r-cfpc-23r5

medium2026-03-07

CVE-2026-30870-PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`

powersync-ja/powersync-service · GHSA-q6wc-xx4m-92fj

critical2026-03-07

CVE-2026-30869-SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

siyuan-note/siyuan · GHSA-2h2p-mvfx-868w

high2026-03-07

CVE-2026-33010-mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft

doobidoo/mcp-memory-service · GHSA-g9rg-8vq5-mpwm

medium2026-03-07

Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)

firefly-iii/firefly-iii · GHSA-5q8v-j673-m5v4

critical2026-03-07

CVE-2026-30861-WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation

tencent/weknora · GHSA-r55h-3rwj-hcmg

critical2026-03-06

CVE-2026-30860-WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool

tencent/weknora · GHSA-8w32-6mrw-q5wv

high2026-03-06

CVE-2026-30859-WeKnora has Broken Access Control - Cross-Tenant Data Exposure

tencent/weknora · GHSA-2f4c-vrjq-rcgv

high2026-03-06

CVE-2026-30858-WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources

tencent/weknora · GHSA-h6gw-8f77-mmmp

medium2026-03-06

CVE-2026-30857-WeKnora has Unauthorized Cross‑Tenant Knowledge Base Cloning

tencent/weknora · GHSA-8rf9-c59g-f82f

medium2026-03-06

CVE-2026-30856-WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection

tencent/weknora · GHSA-67q9-58vj-32qx

critical2026-03-06

CVE-2026-30855-WeKnora Vulnerable to Broken Access Control in Tenant Management

tencent/weknora · GHSA-ccj6-79j6-cq5q

medium2026-03-06

CVE-2026-30852-Caddy's vars_regexp double-expands user input, leaking env vars and files

caddyserver/caddy · GHSA-m2w3-8f23-hxxf

high2026-03-06

CVE-2026-30851-Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

caddyserver/caddy · GHSA-7r4p-vjf4-gxv4