Security advisories

low2026-02-25

CVE-2026-56376-ImageMagick has a possible heap Use After Free vulnerability in its meta coder

imagemagick/imagemagick · GHSA-2gq3-ww97-wfjm

low2026-02-25

CVE-2026-56383-Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

craftcms/cms · GHSA-6j87-m5qx-9fqp

high2026-02-25

CVE-2026-27696-changedetection.io is Vulnerable to SSRF via Watch URLs

dgtlmoon/changedetection.io · GHSA-3c45-4pj5-ch7m

medium2026-02-25

CVE-2026-27645-changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response

dgtlmoon/changedetection.io · GHSA-mw8m-398g-h89w

critical2026-02-25

CVE-2026-27641-Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

jugmac00/flask-reuploaded · GHSA-65mp-fq8v-56jr

high2026-02-25

CVE-2026-27610-Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions

parse-community/parse-dashboard · GHSA-jhp4-jvq3-w5xr

high2026-02-25

CVE-2026-27609-Parse Dashboard is Missing CSRF Protection for its Agent Endpoint

parse-community/parse-dashboard · GHSA-3534-xp88-25rc

critical2026-02-25

CVE-2026-27608-Parse Dashboard is Missing Authorization for its Agent Endpoint

parse-community/parse-dashboard · GHSA-cvwj-6c9h-jg6v

high2026-02-25

CVE-2026-25733-Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function

rucio/rucio · GHSA-rwj9-7j48-9f7q

critical2026-02-25

CVE-2026-27702-Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)

budibase/budibase · GHSA-rvhr-26g4-p2r8

high2026-02-25

CVE-2026-27732-AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

wwbn/avideo · GHSA-h39h-7cvg-q7j6

medium2026-02-25

CVE-2026-25138-Rucio WebUI has Username Enumeration via Login Error Message

rucio/rucio · GHSA-38wq-6q2w-hcf9

high2026-02-25

CVE-2026-25136-Rucio WebUI has a Reflected Cross-site Scripting Vulnerability

rucio/rucio · GHSA-h79m-5jjm-jm4q

critical2026-02-25

CVE-2026-27595-Parse Dashboard has incomplete authentication on AI Agent endpoint

parse-community/parse-dashboard · GHSA-qwc3-h9mg-4582

high2026-02-25

CVE-2026-27830-c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

swaldman/c3p0 · GHSA-5476-xc4j-rqcv

medium2026-02-25

CVE-2026-26717-OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function

openfun/richie · GHSA-xjhr-fm27-4hmx

low2026-02-25

CVE-2026-24005-OpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field

openkruise/kruise · GHSA-9fj4-3849-rv9g

low2026-02-25

CVE-2026-22866-ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation

ensdomains/ens-contracts · GHSA-c6rr-7pmc-73wc

high2026-02-25

CVE-2026-27727-mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

swaldman/mchange-commons-java · GHSA-m2cm-222f-qw44

medium2026-02-25

CVE-2026-27829-Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize

withastro/astro · GHSA-cj9f-h6r6-4cx2