Security advisories

high2026-09-25

CVE-2026-57443-SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

View chart →

issdandavis/scbe-aethermoore · GHSA-q986-4x7x-gx39

high2026-09-25

mpp vulnerable to Gas Draining with low gas limit

View chart →

zenhive/mpp · GHSA-vj8p-hp9x-gh47

medium2026-09-25

mpp vulnerable to Gas Draining with access list

View chart →

zenhive/mpp · GHSA-qpxh-ff8m-c62v

high2026-09-25

mpp vulnerable to Gas Draining with no limit

View chart →

zenhive/mpp · GHSA-vv77-66rf-pm86

high2026-09-25

CVE-2026-100368-CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers

View chart →

alastairlundy/cliinvoke · GHSA-wrvw-254r-wpmv

high2026-09-25

CVE-2026-100369-CliInvoke: Argument Injection in Extensibility Runner Factory

View chart →

alastairlundy/cliinvoke · GHSA-j73w-8hfr-4gc9

high2026-09-25

khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

View chart →

khoj-ai/khoj · GHSA-62mm-xwmv-crhg

high2026-09-25

CVE-2026-86439-Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

View chart →

knowns-dev/knowns · GHSA-9gfj-28hw-jchp

high2026-09-25

OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet

View chart →

openzeppelin/openzeppelin-confidential-contracts · GHSA-29h2-jr22-frmh

medium2026-09-25

CVE-2026-53493-Containerd has image-pull DoS via crafted OCI index graph amplification

View chart →

containerd/containerd · GHSA-pg57-6jwg-q645

critical2026-09-25

CVE-2026-92161-FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

View chart →

friendsofflarum/oauth · GHSA-g7vj-c29h-3h5m

high2026-09-25

CVE-2026-57440-Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

View chart →

starcitizenwiki/mediawiki-extensions-embedvideo · GHSA-v65j-hff3-753c

high2026-09-25

CVE-2026-61823-code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

View chart →

code16/sharp · GHSA-qxg3-46rw-79j8

high2026-09-25

CVE-2026-61825-code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

View chart →

code16/sharp · GHSA-vj3q-vp3g-j9c8

low2026-09-24

CVE-2026-57232-Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

View chart →

contao/contao · GHSA-87mg-5grr-rhwh

medium2026-09-24

CVE-2026-57179-social-auth-core has a Session Fixation issue

View chart →

python-social-auth/social-core · GHSA-vqg6-3fw6-j9jg

high2026-09-24

CVE-2026-57178-social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

View chart →

python-social-auth/social-core · GHSA-3c93-f73f-qc9h

medium2026-09-24

CVE-2026-57177-social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

View chart →

python-social-auth/social-core · GHSA-x7qq-23vw-7pfg

medium2026-09-24

CVE-2026-57176-social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

View chart →

python-social-auth/social-core · GHSA-fp7w-m676-w7gc

medium2026-09-24

CVE-2026-57175-social-auth-core has an Improper Authentication issue

View chart →

python-social-auth/social-core · GHSA-vq6g-g6c7-5f2j