Security advisories

high2026-02-06

CVE-2026-24135-Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update

gogs/gogs · GHSA-jp7c-wj6q-3qf2

medium2026-02-06

CVE-2026-23633-Gogs has arbitrary file read/write via Path Traversal in Git hook editing

gogs/gogs · GHSA-mrph-w4hh-gx3g

medium2026-02-06

CVE-2026-23632- Gogs user can update repository content with read-only permission

gogs/gogs · GHSA-5qhx-gwfj-6jqr

medium2026-02-06

CVE-2026-22592-Gogs has a Denial of Service issue

gogs/gogs · GHSA-cr88-6mqm-4g57

high2026-02-06

CVE-2025-69216-OpenSTAManager has a SQL Injection in Scadenzario Print Template

devcode-it/openstamanager · GHSA-q6g3-fv43-m2w6

high2026-02-06

CVE-2025-69214-OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)

devcode-it/openstamanager · GHSA-qjv8-63xq-gq8m

critical2026-02-06

CVE-2025-69212-OpenSTAManager has an OS Command Injection in P7M File Processing

devcode-it/openstamanager · GHSA-25fp-8w8p-mx36

high2026-02-06

CVE-2025-64175-Gogs Vulnerable to 2FA Bypass via Recovery Code

gogs/gogs · GHSA-p6x6-9mx6-26wj

critical2026-02-06

CVE-2025-64111-Gogs's update .git/config file allows remote command execution

gogs/gogs · GHSA-gg64-xxr9-qhjp

low2026-02-06

CVE-2026-1337-Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log

neo4j/neo4j · GHSA-xr72-g735-4vwp

medium2026-02-05

CVE-2026-25760-Sliver Vulnerable to Website Path Traversal / Arbitrary File Read (Authenticated)

bishopfox/sliver · GHSA-2286-hxv5-cmp2

medium2026-02-05

CVE-2026-24851-OpenFGA Improper Policy Enforcement

openfga/openfga · GHSA-jq9f-gm9w-rwm9

critical2026-02-05

CVE-2026-25641-@nyariv/sandboxjs vulnerable to sandbox escape via TOCTOU bug on keys in property accesses

nyariv/sandboxjs · GHSA-7x3h-rm86-3342

high2026-02-05

OpenCloud Affected by Public Link Exploit

opencloud-eu/opencloud · GHSA-vf5j-r2hw-2hrw

high2026-02-05

CVE-2026-25628-qdrant has arbitrary file write via `/logger` endpoint

qdrant/qdrant · GHSA-f632-vm87-2m2f

high2026-02-05

CVE-2026-25758-Unauthenticated Spree Commerce users can access all guest addresses

spree/spree · GHSA-87fh-rc96-6fr6

high2026-02-05

CVE-2026-25757-Unauthenticated Spree Commerce users can view completed guest orders by Order ID

spree/spree · GHSA-p6pv-q7rc-g4h9

high2026-02-05

CVE-2026-25732-NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write

zauberzeug/nicegui · GHSA-9ffm-fxg3-xrhh

critical2026-02-05

CVE-2026-25587-@nyariv/sandboxjs has a Sandbox Escape vulnerability

nyariv/sandboxjs · GHSA-66h4-qj4x-38xp

critical2026-02-05

CVE-2026-25586-@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution

nyariv/sandboxjs · GHSA-jjpw-65fv-8g48