Security advisories

medium2026-02-24

CVE-2026-27204-Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

bytecodealliance/wasmtime · GHSA-852m-cvvp-9p4w

medium2026-02-24

CVE-2026-27195-Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

bytecodealliance/wasmtime · GHSA-xjhv-v822-pf94

high2026-02-24

CVE-2026-27590-Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport

caddyserver/caddy · GHSA-5r3v-vc8m-m96g

medium2026-02-24

CVE-2026-27589-Caddy is vulnerable to cross-origin config application via local admin API /load

caddyserver/caddy · GHSA-879p-475x-rqh2

high2026-02-24

CVE-2026-27588-Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass

caddyserver/caddy · GHSA-x76f-jf84-rqj8

high2026-02-24

CVE-2026-27587-Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass

caddyserver/caddy · GHSA-g7pc-pc7g-h8jh

high2026-02-24

CVE-2026-27586-Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed

caddyserver/caddy · GHSA-hffm-g8v7-wrv7

medium2026-02-24

CVE-2026-27585-Caddy: Improper sanitization of glob characters in file matcher may lead to bypassing security protections

caddyserver/caddy · GHSA-4xrr-hq4w-6vf4

critical2026-02-24

CVE-2026-27584-ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

actualbudget/actual · GHSA-m2cq-xjgm-f668

medium2026-02-24

CVE-2026-27567-Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads

payloadcms/payload · GHSA-hhfx-5x8j-f5f6

high2026-02-24

CVE-2026-27483-MindsDB: Path Traversal in /api/files Leading to Remote Code Execution

mindsdb/mindsdb · GHSA-4894-xqv6-vrfq

medium2026-02-24

CVE-2026-27461-Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause

pimcore/pimcore · GHSA-vxg3-v4p6-f3fp

medium2026-02-24

CVE-2026-27156-NiceGUI vulnerable to XSS via Code Injection during client-side element function execution

zauberzeug/nicegui · GHSA-78qv-3mpx-9cqq

critical2026-02-24

CVE-2025-69985-FUXA has JWT Authentication Bypass via HTTP Referer header spoofing

frangoteam/fuxa · GHSA-4r4r-4jp4-wwf9

medium2026-02-24

CVE-2026-27571-nats-server websockets are vulnerable to pre-auth memory DoS

nats-io/nats-server · GHSA-qrvq-68c2-7grw

medium2026-02-24

CVE-2026-27469-Isso affected by Stored XSS via comment website field

isso-comments/isso · GHSA-9fww-8cpr-q66r

critical2026-02-24

CVE-2026-27574-OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE

oneuptime/oneuptime · GHSA-v264-xqh4-9xmm

medium2026-02-24

CVE-2026-27129-Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution

craftcms/cms · GHSA-v2gc-rm6g-wrw9

medium2026-02-24

CVE-2026-26983-ImageMagick: Invalid MSL <map> can result in a use after free

imagemagick/imagemagick · GHSA-w8mw-frc6-r7m8

medium2026-02-24

CVE-2026-26283-ImageMagick has a possible infinite loop in its JPEG encoder when using `jpeg:extent`

imagemagick/imagemagick · GHSA-gwr3-x37h-h84v