Security advisories

critical2026-02-25

CVE-2026-27728-OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

oneuptime/oneuptime · GHSA-jmhp-5558-qxh5

high2026-02-25

CVE-2026-27700-Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

honojs/hono · GHSA-xh87-mx6m-69f3

high2026-02-25

Sliver has Potential Zip Bomb Denial of Service in GzipEncoder

bishopfox/sliver · GHSA-2phg-qgmm-r638

critical2026-02-25

CVE-2026-27597-@enclave-vm/core is vulnerable to Sandbox Escape

agentfront/enclave · GHSA-f229-3862-4942

critical2026-02-25

CVE-2026-27626-OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

olivetin/olivetin · GHSA-49gm-hh7w-wfvf

low2026-02-25

CVE-2026-27628-pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

py-pdf/pypdf · GHSA-2rw7-x74f-jg35

medium2026-02-25

CVE-2026-27621-TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload

typicms/core · GHSA-xfvg-8v67-j7wp

critical2026-02-25

CVE-2026-27614-Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering

bugsink/bugsink · GHSA-vp6q-7m36-pq3w

medium2026-02-25

CVE-2026-27612-repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard

denpiligrim/repostat · GHSA-fm8c-6m29-rp6j

high2026-02-25

CVE-2026-27611-FileBrowser Quantum: Password Protection Not Enforced on Shared File Links

gtsteffaniak/filebrowser · GHSA-8vrh-3pm2-v4v6

medium2026-02-25

Fickling has safety check bypass via REDUCE+BUILD opcode sequence

trailofbits/fickling · GHSA-mhc9-48gj-9gp3

low2026-02-25

CVE-2026-56367-ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds

imagemagick/imagemagick · GHSA-273h-m46v-96q4

high2026-02-25

CVE-2025-50180-esm.sh is vulnerable to full-response SSRF

esm-dev/esm.sh · GHSA-3c9r-837r-qqm4

high2026-02-24

CVE-2026-27598-Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory

dagu-org/dagu · GHSA-6v48-fcq6-ff23

high2026-02-24

Fickling: OBJ opcode call invisibility bypasses all safety checks

trailofbits/fickling · GHSA-mxhj-88fx-4pcv

critical2026-02-24

CVE-2026-27593-Statamic is vulnerable to account takeover via password reset link injection

statamic/cms · GHSA-jxq9-79vj-rgvw

medium2026-02-24

CVE-2026-27572-Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

bytecodealliance/wasmtime · GHSA-243v-98vx-264h

medium2026-02-24

CVE-2026-25882-Fiber has a Denial of Service Vulnerability via Route Parameter Overflow

gofiber/fiber · GHSA-mrq8-rjmw-wpq3

high2026-02-24

CVE-2026-25899-Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation

gofiber/fiber · GHSA-2mr3-m5q5-wgp6

high2026-02-24

CVE-2026-25891-Fiber has an Arbitrary File Read in Static Middleware on Windows

gofiber/fiber · GHSA-m3c2-496v-cw3v