Security advisories

medium2026-03-01

CVE-2026-28424-Statamic's missing authorization allows access to email addresses

statamic/cms · GHSA-w878-f8c6-7r63

medium2026-03-01

CVE-2026-28423-Statamic Vulnerable to Server-Side Request Forgery via Glide

statamic/cms · GHSA-cwpp-325q-2cvp

high2026-03-01

CVE-2026-28416-Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing

gradio-app/gradio · GHSA-jmh7-g254-2cq9

medium2026-03-01

CVE-2026-28415-Gradio has an Open Redirect in its OAuth Flow

gradio-app/gradio · GHSA-pfjf-5gxr-995x

high2026-03-01

CVE-2026-28414-Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+

gradio-app/gradio · GHSA-39mp-8hj3-5c49

high2026-03-01

CVE-2026-28406-kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories

chainguard-forks/kaniko · GHSA-6rxq-q92g-4rmf

low2026-03-01

CVE-2026-21619-hex_core has Unsafe Deserialization of Erlang Terms

hexpm/hex_core · GHSA-hx9w-f2w9-9g96

medium2026-03-01

CVE-2026-28352-Indico has a missing access check in the event series management API

indico/indico · GHSA-rfpp-2hgm-gp5v

high2026-03-01

INSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints

romitou/insatutorat · GHSA-xfx2-prg5-jq3g

high2026-03-01

CVE-2026-3304-Multer vulnerable to Denial of Service via incomplete cleanup

expressjs/multer · GHSA-xf7r-hgr6-v32p

high2026-03-01

CVE-2026-2359-Multer vulnerable to Denial of Service via resource exhaustion

expressjs/multer · GHSA-v52c-386h-88mc

low2026-03-01

CVE-2026-27167-Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret

gradio-app/gradio · GHSA-h3h8-3v2v-rg7m

high2026-02-28

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

yahoo/serialize-javascript · GHSA-5c6j-r48x-rmvq

medium2026-02-28

CVE-2026-28407-malcontent: Nested archive extraction failure can drop content from scan inputs

chainguard-dev/malcontent · GHSA-945p-3jhm-6rcp

medium2026-02-28

CVE-2026-28338-PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

pmd/pmd · GHSA-8rr6-2qw5-pc7r

high2026-02-28

CVE-2026-2880-@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware

fastify/middie · GHSA-8p85-9qpw-fwgw

medium2026-02-28

CVE-2026-28351-pypdf: Manipulated RunLengthDecode streams can exhaust RAM

py-pdf/pypdf · GHSA-f2v5-7jq9-h8cg

medium2026-02-28

CVE-2026-28280-osctrl has Stored Cross-Site Scripting (XSS) in On-Demand Query List

jmpsec/osctrl · GHSA-4rv8-5cmm-2r22

high2026-02-28

CVE-2026-28279-osctrl is Vulnerable to OS Command Injection via Environment Configuration

jmpsec/osctrl · GHSA-rchw-322g-f7rm

low2026-02-28

SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)

sveltejs/kit · GHSA-fpg4-jhqr-589c