Security advisories

medium2026-02-13

CVE-2026-22892-Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts

mattermost/mattermost · GHSA-9pj7-jh2r-87g8

low2026-02-13

CVE-2026-20796-Mattermost doesn't properly validate channel membership at the time of data retrieval

mattermost/mattermost · GHSA-2xf7-hmf6-p64j

medium2026-02-13

CVE-2026-1721-Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler

cloudflare/agents · GHSA-cvhv-6xm6-c3v4

low2026-02-12

CVE-2025-67860-NeuVector scanner insecurely handles passwords as command arguments

neuvector/scanner · GHSA-3c9m-gq32-g4jx

medium2026-02-12

CVE-2026-26185-Directus Vulnerable to User Enumeration via Password Reset Timing Attack

directus/directus · GHSA-jr94-gj3h-c8rf

low2026-02-12

Bug-Fixes in `libcrux-ecdh`, `libcrux-ed25519`, `libcrux-psq`

cryspen/libcrux · GHSA-435g-fcv3-8j26

high2026-02-12

MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

cesargb/laravel-magiclink · GHSA-r33w-fg8j-9c94

medium2026-02-12

SurrealDB vulnerable to Denial of Service through scripting function memory edge case

surrealdb/surrealdb · GHSA-xx7m-69ff-9crp

high2026-02-12

CVE-2026-26056-Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC

yokecd/yoke · GHSA-wj8p-jj64-h7ff

high2026-02-12

CVE-2026-26055-Unauthenticated Admission Webhook Endpoints in Yoke ATC

yokecd/yoke · GHSA-965m-v4cc-6334

medium2026-02-12

CVE-2025-56647-@farmfe/core is Missing Origin Validation in WebSocket

farm-fe/farm · GHSA-p773-8mf4-rjm5

high2026-02-12

CVE-2026-26063-CediPay Affected by Improper Input Validation in Payment Processing

xpertforextradeinc/cedipay · GHSA-wvr6-395c-5pxr

low2026-02-12

CVE-2026-2391-qs's arrayLimit bypass in comma parsing allows denial of service

ljharb/qs · GHSA-w7fw-mjwx-w883

medium2026-02-12

CVE-2026-26000-XWiki vulnerable to click-jacking through CSS injection in comments

xwiki/xwiki-platform · GHSA-74rh-c5rh-88vg

high2026-02-12

CVE-2026-25949-Traefik: TCP readTimeout bypass via STARTTLS on Postgres

traefik/traefik · GHSA-89p3-4642-cr2w

high2026-02-12

CVE-2026-24895-FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP

php/frankenphp · GHSA-g966-83w7-6w38

high2026-02-12

CVE-2026-24894-FrankenPHP leaks session data between requests in worker mode

php/frankenphp · GHSA-r3xh-3r3w-47gp

medium2026-02-12

CVE-2026-21438-webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map

quic-go/webtransport-go · GHSA-2f2x-8mwp-p2gc

medium2026-02-12

CVE-2026-21435-webtransport-go: CloseWithError can block indefinitely

quic-go/webtransport-go · GHSA-px4r-g4p3-hhqv

medium2026-02-12

CVE-2026-21434-webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule

quic-go/webtransport-go · GHSA-g6x7-jq8p-6q9q