Security advisories

medium2026-02-05

CVE-2026-25574-payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)

payloadcms/payload · GHSA-jq29-r496-r955

critical2026-02-05

CVE-2026-25544-@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

payloadcms/payload · GHSA-xx6w-jxg9-2wh8

critical2026-02-05

CVE-2026-25520-@nyariv/sandboxjs has a Sandbox Escape issue

nyariv/sandboxjs · GHSA-58jh-xv4v-pcx4

high2026-02-05

CVE-2026-23989-OpenCloud Reva has a Public Link Exploit

opencloud-eu/reva · GHSA-9j2f-3rj3-wgpg

low2026-02-05

CVE-2025-68458-webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

webpack/webpack · GHSA-8fgc-7cc6-rx7x

low2026-02-05

CVE-2025-68157-webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence

webpack/webpack · GHSA-38r7-794h-5758

low2026-02-05

CVE-2025-70792-Microweber Cross-site Scripting vulnerability

microweber/microweber · GHSA-6w5w-jx4x-vjvw

low2026-02-05

CVE-2025-70791-Microweber has a Cross-site Scripting vulnerability

microweber/microweber · GHSA-5jg5-xqfw-rv92

high2026-02-05

CVE-2026-1707-pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability

pgadmin-org/pgadmin4 · GHSA-3p7x-94q9-jq9x

critical2026-02-05

FrankenPHP has delayed propagation of security fixes in upstream base images

php/frankenphp · GHSA-x9p2-77v6-6vhf

medium2026-02-05

CVE-2026-25727-time vulnerable to stack exhaustion Denial of Service attack

time-rs/time · GHSA-r6v5-fh4h-64xc

medium2026-02-05

CVE-2026-25533-Sandbox escape via infinite recursion and error objects

agentfront/enclave · GHSA-x39w-8vm5-5m3p

medium2026-02-05

CVE-2026-25516-NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

zauberzeug/nicegui · GHSA-v82v-c5x8-w282

medium2026-02-05

CVE-2026-25198-web2py has an Open Redirect Vulnerability

web2py/web2py · GHSA-rf8c-3f5p-xv45

critical2026-02-05

CVE-2026-25752-FUXA Unauthenticated Remote Arbitrary Device Tag Write

frangoteam/fuxa · GHSA-ggxw-g3cp-mgf8

critical2026-02-05

CVE-2026-25895-FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

frangoteam/fuxa · GHSA-88qh-cphv-996c

critical2026-02-05

CVE-2026-25894-FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

frangoteam/fuxa · GHSA-32cc-x95p-fxcg

critical2026-02-05

CVE-2026-25751-FUXA Unauthenticated Exposure of Plaintext Database Credentials

frangoteam/fuxa · GHSA-c5gq-4h56-4mmx

critical2026-02-05

CVE-2026-25893-FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

frangoteam/fuxa · GHSA-vwcg-c828-9822

medium2026-02-04

CVE-2023-43637-EVE Has Partially Predetermined Vault Key

lf-edge/eve · GHSA-g7vp-j25f-h34p