Security advisories

medium2026-02-26

CVE-2026-27808-Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API

axllent/mailpit · GHSA-mpf7-p9x7-96r3

medium2026-02-26

CVE-2026-27735-mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

modelcontextprotocol/servers · GHSA-vjqx-cfc4-9h6v

high2026-02-26

CVE-2026-27148-Storybook Dev Server is Vulnerable to WebSocket Hijacking

storybookjs/storybook · GHSA-mjf5-7g4m-gx5w

medium2026-02-26

CVE-2026-26186-Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter

fleetdm/fleet · GHSA-49xw-vfc4-7p43

critical2026-02-25

CVE-2026-27804-Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

parse-community/parse-server · GHSA-4q3h-vp4r-prv2

critical2026-02-25

CVE-2026-27822-Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

rustfs/rustfs · GHSA-v9fg-3cr2-277j

medium2026-02-25

CVE-2026-27795-LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

langchain-ai/langchainjs · GHSA-mphv-75cg-56wg

medium2026-02-25

CVE-2026-27794-LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

langchain-ai/langgraph · GHSA-mhr3-j7m5-c7c9

high2026-02-25

CVE-2026-27730-esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route

esm-dev/esm.sh · GHSA-p2v6-84h2-5x4r

critical2026-02-25

CVE-2026-27739-Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

angular/angular-cli · GHSA-x288-3778-4hhx

medium2026-02-25

CVE-2026-27738-Angular SSR has an Open Redirect via X-Forwarded-Prefix

angular/angular-cli · GHSA-xh43-g2fq-wjrj

high2026-02-25

CVE-2026-27616-Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure

go-vikunja/vikunja · GHSA-7jp5-298q-jg98

high2026-02-25

CVE-2026-27607-RustFS: Missing Post Policy Validation leads to Arbitrary Object Write

rustfs/rustfs · GHSA-w5fh-f8xh-5x3p

high2026-02-25

CVE-2026-27606-Rollup 4 has Arbitrary File Write via Path Traversal

rollup/rollup · GHSA-mw96-cpmx-2vgc

critical2026-02-25

CVE-2026-27699-Basic FTP has Path Traversal Vulnerability in its downloadToDir() method

patrickjuchli/basic-ftp · GHSA-5rq4-664w-9x2c

medium2026-02-25

CVE-2026-27729-Astro has memory exhaustion DoS due to missing request body size limit in Server Actions

withastro/astro · GHSA-jm64-8m5q-4qh8

medium2026-02-25

CVE-2026-27695-zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service

zeroae/zae-limiter · GHSA-76rv-2r9v-c5m6

high2026-02-25

CVE-2026-27578-n8n Vulnerable to Stored XSS via Various Nodes

n8n-io/n8n · GHSA-2p9h-rqjw-gm92

critical2026-02-25

CVE-2026-27577-n8n: Expression Sandbox Escape Leads to RCE

n8n-io/n8n · GHSA-vpcf-gvg4-6qwr

critical2026-02-25

CVE-2026-27575-Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

go-vikunja/vikunja · GHSA-3ccg-x393-96v8