Security advisories

medium2026-09-24

CVE-2026-55736-Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets

View chart →

ash-project/ash · GHSA-f4hc-ppw9-4hhw

high2026-09-24

CVE-2026-57171-Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

View chart →

oscal-compass/compliance-trestle · GHSA-r4vp-3vw6-r2x5

high2026-09-24

CVE-2026-57170-Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

View chart →

oscal-compass/compliance-trestle · GHSA-mr95-65j8-9mxp

high2026-09-24

CVE-2026-59723-Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

View chart →

cline/cline · GHSA-3cj3-hqcr-g934

high2026-09-24

CVE-2026-61815-zbateson/mail-mime-parser has CRLF header injection via attachment filename

View chart →

zbateson/mail-mime-parser · GHSA-36h5-qg4p-q2qf

high2026-09-24

CVE-2026-61816-zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

View chart →

zbateson/mail-mime-parser · GHSA-f6v3-2qmr-vfjx

medium2026-09-24

CVE-2026-59980-hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

View chart →

python-hyper/hpack · GHSA-8v8h-hg4w-mvq2

high2026-09-24

CVE-2026-61782-@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

View chart →

web-infra-dev/rsdoctor · GHSA-jmg2-rcxh-w8q3

high2026-09-24

CVE-2026-57231-Podman: Malformed Image can trick podman run into leaking host environment variables into the container

View chart →

podman-container-tools/podman · GHSA-4hq8-gpf5-8p68

medium2026-09-24

CVE-2026-56742-Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

View chart →

cilium/cilium · GHSA-w7c2-w76w-5hmj

high2026-09-24

CVE-2026-61788-@bytebase/dbhub's read-only mode does not prevent database writes

View chart →

bytebase/dbhub · GHSA-mwwr-p57h-56pf

critical2026-09-24

CVE-2026-61742-DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

View chart →

bytebase/dbhub · GHSA-fm8p-53ww-hf6w

critical2026-09-24

CVE-2026-61741-http4s-scala-xml has an XML External Entity (XXE) processing issue

View chart →

http4s/http4s-scala-xml · GHSA-cjx3-73hr-rpw7

medium2026-09-24

CVE-2026-61784-xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

View chart →

cstigler/node-xhtml-purifier · GHSA-j8r4-32c5-33rc

high2026-09-24

CVE-2026-56744-`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

View chart →

bsv-blockchain/ts-stack · GHSA-36f9-7rg5-cpf8

high2026-09-24

CVE-2026-56738-phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

View chart →

thorsten/phpmyfaq · GHSA-rw77-vq4g-x3hp

high2026-09-24

CVE-2026-56737-phpMyFAQ's two-factor authentication login bypasses the password factor

View chart →

thorsten/phpmyfaq · GHSA-8gpw-xvpf-hvx5

high2026-09-24

CVE-2026-56736-phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

View chart →

thorsten/phpmyfaq · GHSA-pgwp-vc7q-cvj3

high2026-09-24

langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs

View chart →

langchain-ai/langchain-nvidia · GHSA-g28h-2cmm-rj9x

medium2026-09-24

CVE-2026-57439-CyberChef: Prototype pollution in Series Chart operation

View chart →

gchq/cyberchef · GHSA-fx6f-382r-j72c