Security advisories

medium2026-03-04

CVE-2026-29038-changedetection.io has Reflected XSS in its RSS Tag Error Response

dgtlmoon/changedetection.io · GHSA-8whx-v8qq-pq64

high2026-03-04

CVE-2026-28802-Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification

authlib/authlib · GHSA-7wc2-qxgw-g8gg

high2026-03-04

CVE-2026-29178-Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint

lemmynet/lemmy · GHSA-jvxv-2jjp-jxc3

high2026-03-04

CVE-2026-29069-Craft CMS has unauthenticated activation email trigger with potential user enumeration

craftcms/cms · GHSA-234q-vvw3-mrfq

medium2026-03-04

CVE-2026-28685-Kimai's API invoice endpoint missing customer-level access control (IDOR)

kimai/kimai · GHSA-v33r-r6h2-8wr7

high2026-03-04

CVE-2026-28681-IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links

irrdnet/irrd · GHSA-22m3-c7vp-49fj

high2026-03-04

CVE-2026-29091-locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection

locutusjs/locutus · GHSA-fp25-p6mj-qqg6

medium2026-03-04

CVE-2026-3351-lxd's non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints

canonical/lxd · GHSA-crmg-9m86-636r

medium2026-03-04

neqo-qpack has iInteger overflow in qpack dynamic table indexing

mozilla/neqo · GHSA-6w86-wgwq-rgq8

medium2026-03-04

CVE-2026-27898-Vaultwarden has Unauthorized Access via Partial Update API on Another User’s Cipher

dani-garcia/vaultwarden · GHSA-w9f8-m526-h7fh

high2026-03-04

CVE-2026-27803-Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role

dani-garcia/vaultwarden · GHSA-h4hq-rgvh-wh27

high2026-03-04

CVE-2026-27802-Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

dani-garcia/vaultwarden · GHSA-r32r-j5jq-3w4m

medium2026-03-04

CVE-2026-27801-Vaultwarden has 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

dani-garcia/vaultwarden · GHSA-v6pg-v89r-w8wr

high2026-03-04

CVE-2026-29087-@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

honojs/node-server · GHSA-wc8c-qw6v-h7f6

medium2026-03-04

CVE-2026-29086-Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()

honojs/hono · GHSA-5pq2-9x2x-5p6w

medium2026-03-04

CVE-2026-29085-Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()

honojs/hono · GHSA-p6xx-57qc-3wxr

high2026-03-04

CVE-2026-29045-Hono vulnerable to arbitrary file access via serveStatic vulnerability

honojs/hono · GHSA-q5qw-h33p-qvwr

medium2026-03-04

CVE-2026-22170-OpenClaw: BlueBubbles (optional plugin) pairing/allowlist mismatch when allowFrom is empty

openclaw/openclaw · GHSA-jwf4-8wf4-jf2m

medium2026-03-04

OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection

openclaw/openclaw · GHSA-jjgj-cpp9-cvpv

high2026-03-04

OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations

openclaw/openclaw · GHSA-3jx4-q2m7-r496