Security advisories

medium2026-03-06

CVE-2026-30838-CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names

thephpleague/commonmark · GHSA-4v6x-c7xx-hw9f

medium2026-03-06

CVE-2026-30835-parse-server: Malformed `$regex` query leaks database error details in API response

parse-community/parse-server · GHSA-9cp7-3q5w-j92g

high2026-03-06

CVE-2026-30824-Flowise Missing Authentication on NVIDIA NIM Endpoints

flowiseai/flowise · GHSA-5f53-522j-j454

high2026-03-06

CVE-2026-30823-Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration

flowiseai/flowise · GHSA-cwc3-p92j-g7qm

high2026-03-06

CVE-2026-30822-Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

flowiseai/flowise · GHSA-mq4r-h2gh-qv7x

critical2026-03-06

CVE-2026-30832-soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import

charmbracelet/soft-serve · GHSA-3fvx-xrxq-8jvv

high2026-03-06

CVE-2026-29064-Zarf's symlink targets in archives are not validated against destination directory

zarf-dev/zarf · GHSA-hcm4-6hpj-vghm

high2026-03-06

CVE-2026-26018-CoreDNS Loop Detection Denial of Service Vulnerability

coredns/coredns · GHSA-h75p-j8xm-m278

high2026-03-06

CVE-2026-30821-Flowise has Arbitrary File Upload via MIME Spoofing

flowiseai/flowise · GHSA-j8g8-j7fc-43v6

high2026-03-06

CVE-2026-30820-Flowise has Authorization Bypass via Spoofed x-request-from Header

flowiseai/flowise · GHSA-wvhq-wp8g-c7vq

low2026-03-06

CVE-2026-30241-Mercurius's queryDepth limit bypassed for WebSocket subscriptions

mercurius-js/mercurius · GHSA-m4h2-mjfm-mp55

high2026-03-06

CVE-2026-30229-parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

parse-community/parse-server · GHSA-79wj-8rqv-jvp5

medium2026-03-06

CVE-2026-30228-parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction

parse-community/parse-server · GHSA-xfh7-phr7-gr2x

medium2026-03-06

Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens

vercel/workflow · GHSA-9r75-g2cr-3h76

high2026-03-06

CVE-2026-30834-PinchTab has SSRF with Full Response Exfiltration via Download Handler

pinchtab/pinchtab · GHSA-rw8p-c6hf-q3pg

low2026-03-06

CVE-2026-30830-defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag

kepano/defuddle · GHSA-5mq8-78gm-pjmq

high2026-03-06

CVE-2026-30827-express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network

express-rate-limit/express-rate-limit · GHSA-46wh-pxpv-q5gq

high2026-03-06

CVE-2025-15602-Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment

grokability/snipe-it · GHSA-5448-v74m-7mv7

high2026-03-06

CVE-2026-26017-CoreDNS ACL Bypass

coredns/coredns · GHSA-c9v3-4pv7-87pr

high2026-03-06

CVE-2026-29783-GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution

github/copilot-cli · GHSA-g8r9-g2v8-jv6f