Security advisories

high2026-02-26

CVE-2026-27899-WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level

h44z/wg-portal · GHSA-5rmx-256w-8mj9

high2026-02-26

CVE-2026-27896-MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

modelcontextprotocol/go-sdk · GHSA-wvj2-96wp-fq3f

medium2026-02-26

CVE-2026-27839-wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup

wger-project/wger · GHSA-g8gc-6c4h-jg86

low2026-02-26

CVE-2026-27838-wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data

wger-project/wger · GHSA-42cr-w2gr-m54q

medium2026-02-26

CVE-2026-27835-wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data

wger-project/wger · GHSA-xf68-8hjw-7mpm

high2026-02-26

CVE-2026-27903-minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

isaacs/minimatch · GHSA-7r86-cg39-jmmj

high2026-02-26

CVE-2026-27904-minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

isaacs/minimatch · GHSA-23c5-xmqv-rm74

medium2026-02-26

CVE-2026-27900-Terraform Provider for Linode Debug Logs Vulnerable to Sensitive Information Exposure

linode/terraform-provider-linode · GHSA-5rc7-2jj6-mp64

medium2026-02-26

CVE-2026-27888-pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

py-pdf/pypdf · GHSA-x7hp-r3qg-r3cj

medium2026-02-26

CVE-2026-27837-dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform()

mickhansen/dottie.js · GHSA-r5mx-6wc6-7h9w

high2026-02-26

CVE-2026-27465-Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users

fleetdm/fleet · GHSA-2v6m-6xw3-6467

medium2026-02-26

CVE-2026-27457-Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

weblateorg/weblate · GHSA-wppc-7cq7-cgfv

medium2026-02-26

CVE-2026-25963-Fleet: Authorization Bypass in certificate template batch deletion for team administrators

fleetdm/fleet · GHSA-5jvp-m9h4-253h

medium2026-02-26

CVE-2026-24004-Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint

fleetdm/fleet · GHSA-9pm7-6g36-6j78

medium2026-02-26

CVE-2026-23999-Fleet: Device lock PIN can be predicted if lock time is known

fleetdm/fleet · GHSA-ppwx-5jq7-px2w

medium2026-02-26

CVE-2026-56357-n8n: Webhook Forgery on Github Webhook Trigger

n8n-io/n8n · GHSA-mqpr-49jj-32rc

medium2026-02-26

CVE-2026-56351-n8n: SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodes

n8n-io/n8n · GHSA-f3f2-mcxc-pwjx

high2026-02-26

CVE-2026-27819-Vikunja has Path Traversal in CLI Restore

go-vikunja/vikunja · GHSA-42wg-38gx-85rh

high2026-02-26

CVE-2026-27818-TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist

terriajs/terriajs-server · GHSA-w789-49fc-v8hr

medium2026-02-26

CVE-2026-27809-psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps

psd-tools/psd-tools · GHSA-24p2-j2jr-386w