Security advisories

high2026-02-06

Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values

yippee-fun/phlex · GHSA-w67g-2h6v-vjgq

high2026-02-06

CVE-2026-25754-AdonisJS multipart body parsing has Prototype Pollution issue

adonisjs/core · GHSA-f5x2-vj4h-vg4c

high2026-02-06

CVE-2026-25725-Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json

anthropics/claude-code · GHSA-ff64-7w26-62rf

low2026-02-06

CVE-2026-25724-Claude Code has Permission Deny Bypass Through Symbolic Links

anthropics/claude-code · GHSA-4q92-rfm6-2cqx

high2026-02-06

CVE-2026-25723-Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions

anthropics/claude-code · GHSA-mhg7-666j-cqg4

high2026-02-06

CVE-2026-25722-Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

anthropics/claude-code · GHSA-66q4-vfjg-2qhh

medium2026-02-06

[actix-files] Panic triggered by empty Range header in GET request for static file

actix/actix-web · GHSA-gcqf-3g44-vc9p

medium2026-02-06

actix-files has a possible exposure of information vulnerability

actix/actix-web · GHSA-8v2v-wjwg-vx6r

medium2026-02-06

CVE-2026-25651-client-certificate-auth Vulnerable to Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect

tgies/client-certificate-auth · GHSA-m4w9-gch5-c2g4

high2026-02-06

CVE-2026-25650-MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token

smn2gnt/mcp-salesforce · GHSA-vf6j-c56p-cq58

high2026-02-06

CVE-2026-25640-Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL

pydantic/pydantic-ai · GHSA-wjp5-868j-wqv7

critical2026-02-06

CVE-2026-25592-Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK

microsoft/semantic-kernel · GHSA-2ww3-72rp-wpp4

medium2026-02-06

CVE-2026-25581-SCEditor has DOM XSS via emoticon URL/HTML injection

samclarke/sceditor · GHSA-25fq-6qgg-qpj8

high2026-02-06

CVE-2026-25580-Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling

pydantic/pydantic-ai · GHSA-2jrp-274c-jhv3

medium2026-02-06

CVE-2025-70963-Gophish is vulnerable to Incorrect Access Control

gophish/gophish · GHSA-9f8m-9547-2gqm

high2026-02-06

CVE-2025-13523-Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering

mattermost/mattermost-plugin-confluence · GHSA-ffx7-34p2-vm3w

high2026-02-06

CVE-2026-24419-OpenSTAManager has a SQL Injection in the Prima Nota module

devcode-it/openstamanager · GHSA-4j2x-jh4m-fqv6

high2026-02-06

CVE-2026-24418-OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module

devcode-it/openstamanager · GHSA-4xwv-49c8-fvhq

high2026-02-06

CVE-2026-24417-OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service

devcode-it/openstamanager · GHSA-4hc4-8599-xh2h

high2026-02-06

CVE-2026-24416-OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module

devcode-it/openstamanager · GHSA-p864-fqgv-92q4