Security advisories

high2026-03-05

CVE-2026-2836-Pingora vulnerable to cache poisoning via insecure-by-default cache key

cloudflare/pingora · GHSA-f93w-pcj3-rggc

critical2026-03-05

CVE-2026-2835-Pingora has HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

cloudflare/pingora · GHSA-hj7x-879w-vrp7

critical2026-03-05

CVE-2026-2833-Pingora vulnerable to HTTP Request Smuggling via Premature Upgrade

cloudflare/pingora · GHSA-xq2h-p299-vjwv

medium2026-03-05

OliveTin has crash on NPE by calling APIs with invalid bindings or log references

olivetin/olivetin · GHSA-fwhj-785h-43hh

medium2026-03-05

CVE-2026-30225-OliveTin's RestartAction always runs actions as guest

olivetin/olivetin · GHSA-p443-p7w5-2f7f

medium2026-03-05

CVE-2026-30224-OliveTin Session Fixation: Logout Fails to Invalidate Server-Side Session

olivetin/olivetin · GHSA-gq2m-77hf-vwgh

high2026-03-05

CVE-2026-30223-OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes

olivetin/olivetin · GHSA-g962-2j28-3cg9

medium2026-03-05

CVE-2026-29795-stellar-xdr's StringM::from_str bypasses max length validation

stellar/rs-stellar-xdr · GHSA-x57h-xx53-v53w

medium2026-03-05

CVE-2026-29084-Gokapi has CSRF in Login Endpoint

forceu/gokapi · GHSA-hcff-qv74-7hr4

medium2026-03-05

CVE-2026-29061-Gokapi has privilege escalation via incomplete API-key permission revocation on user rank demotion

forceu/gokapi · GHSA-q658-hfpg-35qc

medium2026-03-05

CVE-2026-28277-LangGraph checkpoint loading has unsafe msgpack deserialization

langchain-ai/langgraph · GHSA-g48c-2wqr-h844

high2026-03-05

CVE-2026-26276-Gogs: DOM-based XSS via milestone selection

gogs/gogs · GHSA-vgjm-2cpf-4g7c

medium2026-03-05

CVE-2026-26196-Gogs: Access tokens get exposed through URL params in API requests

gogs/gogs · GHSA-x9p5-w45c-7ffc

medium2026-03-05

CVE-2026-26195-Gogs: Stored XSS in branch and wiki views through author and committer names

gogs/gogs · GHSA-vgvf-m4fw-938j

high2026-03-05

CVE-2026-26194-Gogs: Release tag option injection in release deletion

gogs/gogs · GHSA-v9vm-r24h-6rqm

high2026-03-05

CVE-2026-26022-Gogs: Stored XSS via data URI in issue comments

gogs/gogs · GHSA-xrcr-gmf5-2r8j

critical2026-03-05

CVE-2026-25921-Gogs: Cross-repository LFS object overwrite via missing content hash verification

gogs/gogs · GHSA-cj4v-437j-jq4c

medium2026-03-05

CVE-2026-29060-Gokapi has privilege escalation with auth token

forceu/gokapi · GHSA-m2hx-wjxc-9fp4

high2026-03-05

CVE-2026-28683-Gokapi has Stored XSS in SVG Hotlinks

forceu/gokapi · GHSA-3c22-5j5m-4jq7

medium2026-03-05

CVE-2026-28682-Gokapi has Data Leak in Upload Status Stream

forceu/gokapi · GHSA-c36c-7pc2-f2ph