Security advisories

medium2026-03-05

CVE-2026-29780-eml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write

govcert-lu/eml_parser · GHSA-389r-rccm-h3h5

high2026-03-05

CVE-2026-29186-TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution

backstage/backstage · GHSA-928r-fm4v-mvrw

high2026-03-05

CVE-2025-15558-Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows

docker/cli · GHSA-p436-gjf2-799p

high2026-03-04

CVE-2026-29074-SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)

svg/svgo · GHSA-xpqw-6gx7-v673

high2026-03-04

CVE-2026-29192-ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover

zitadel/zitadel · GHSA-6rx5-m2rc-hmf7

high2026-03-04

CVE-2026-29193-ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication

zitadel/zitadel · GHSA-25rw-g6ff-fmg8

critical2026-03-04

CVE-2026-29191-ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint

zitadel/zitadel · GHSA-pr34-2v5x-6qjq

critical2026-03-04

CVE-2026-29188-File Browser's TUS Delete Endpoint Bypasses Delete Permission Check

filebrowser/filebrowser · GHSA-79pf-vx4x-7jmm

high2026-03-04

CVE-2026-29771-Netmaker Vulnerable to Denial of Service via Server Shutdown Endpoint

gravitl/netmaker · GHSA-rhr9-hgcm-x289

critical2026-03-04

CVE-2026-29183-SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint

siyuan-note/siyuan · GHSA-6865-qjcf-286f

high2026-03-04

CVE-2026-0847-NLTK has a Path Traversal issue

nltk/nltk · GHSA-68j8-pq59-fqgm

high2026-03-04

Fickling missing RCE-capable modules in UNSAFE_IMPORTS

trailofbits/fickling · GHSA-5hwf-rc88-82xm

high2026-03-04

Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked

trailofbits/fickling · GHSA-wccx-j62j-r448

high2026-03-04

CVE-2026-29065-changedetection.io has Zip Slip vulnerability in the backup restore functionality

dgtlmoon/changedetection.io · GHSA-25g8-2mcf-fcx9

high2026-03-04

CVE-2026-29063-Immutable is vulnerable to Prototype Pollution

immutable-js/immutable-js · GHSA-wf6x-7x77-mvgw

high2026-03-04

CVE-2026-29062-jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion

fasterxml/jackson-core · GHSA-6v53-7c9g-w56r

high2026-03-04

CVE-2026-29054-traefik CVE-2024-45410 fix bypass: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)

traefik/traefik · GHSA-92mv-8f8w-wq52

critical2026-03-04

`time_calibrators` was removed from crates.io due to malicious code

suntea279491/time_calibrator · GHSA-wf45-3gpw-vrqv

high2026-03-04

CVE-2026-29042-Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

nuclio/nuclio · GHSA-95fj-3w7g-4r27

high2026-03-04

CVE-2026-29039-changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()

dgtlmoon/changedetection.io · GHSA-6fmw-82m7-jq6p