Security advisories

high2026-03-02

CVE-2026-28492-FileBrowser has Path Traversal in Public Share Links that Exposes Files Outside Shared Directory

filebrowser/filebrowser · GHSA-mr74-928f-rw69

medium2026-03-02

CVE-2026-28413-Products.isurlinportal has possible open redirect when using more than 2 forward slashes

plone/products.isurlinportal · GHSA-43gx-6gv6-3jcp

medium2026-03-02

CVE-2026-28361-NocoDB Missing Ownership Validation in MCP Token Operations

nocodb/nocodb · GHSA-p9x3-w98f-7j3q

medium2026-03-02

CVE-2026-28396-NocoDB's Refresh Tokens Not Revoked on Password Reset

nocodb/nocodb · GHSA-x4vh-j75g-268g

low2026-03-02

CVE-2026-28360-NocoDB has Plaintext Storage of Shared View Passwords

nocodb/nocodb · GHSA-mpp2-x7wv-38hv

medium2026-03-02

CVE-2026-28359-NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field

nocodb/nocodb · GHSA-qxwq-q265-hc44

low2026-03-02

CVE-2026-28358-NocoDB Vulnerable to User Enumeration via Password Reset Endpoint

nocodb/nocodb · GHSA-387m-j3p9-3php

medium2026-03-02

CVE-2026-28357-NocoDB has Stored Cross-site Scripting via Formula Cell

nocodb/nocodb · GHSA-vx5p-q85x-xm3c

medium2026-03-02

CVE-2026-28350-lxml-html-clean has <base> tag injection through default Cleaner configuration

fedora-python/lxml_html_clean · GHSA-xvp8-3mhv-424c

medium2026-03-02

CVE-2026-28348-lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes

fedora-python/lxml_html_clean · GHSA-hw26-mmpg-fqfg

high2026-03-02

CVE-2026-28342-OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint

olivetin/olivetin · GHSA-pc8g-78pf-4xrp

medium2026-03-02

malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability

chainguard-dev/malcontent · GHSA-54p8-x2m9-c593

high2026-03-02

CVE-2026-27932-joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

authlib/joserfc · GHSA-w5r5-m38g-f9f9

critical2026-03-02

`tracing-check` was removed from crates.io for malicious code

polymarket/rs-clob-client · GHSA-5pmp-jpcf-pwx6

high2026-03-02

CVE-2026-27622-OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write

academysoftwarefoundation/openexr · GHSA-cr4v-6jm6-4963

high2026-03-02

CVE-2026-21882-theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution

asfhtgkdavid/theshit · GHSA-2j3p-gqw5-g59j

medium2026-03-02

Bytebase vulnerable to Improper Authentication

bytebase/bytebase · GHSA-5r3p-6rj5-7937

high2026-03-02

CVE-2026-2293-Nest has a Fastify URL Encoding Middleware Bypass

nestjs/nest · GHSA-r4wm-x892-vjmx

high2026-03-01

CVE-2026-28426-Statamic vulnerable to privilege escalation via stored cross-site scripting

statamic/cms · GHSA-5vrj-wf7v-5wr7

high2026-03-01

CVE-2026-28425-Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs

statamic/cms · GHSA-cpv7-q2wx-m8rw