Security advisories

critical2026-09-24

CVE-2026-61604-ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

View chart →

ixofoundation/ixo-blockchain · GHSA-w3rp-4cm2-4wgc

critical2026-09-24

CVE-2026-61732-Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

View chart →

purpleailab/decepticon · GHSA-g5f9-3xfg-p9mf

high2026-09-24

CVE-2026-12958-Language Servers for AWS vulnerable to arbitrary file write

View chart →

aws/language-servers · GHSA-6v3r-4p5c-mrp5

high2026-09-24

CVE-2026-12957-Language Servers for AWS Vulnerable to Arbitrary Code Execution

View chart →

aws/language-servers · GHSA-xhcr-j4j9-3gh7

medium2026-09-24

yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB

View chart →

virustotal/yara-x · GHSA-2jx3-ff3v-j7jj

high2026-09-24

CVE-2026-63498-Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

View chart →

grokability/snipe-it · GHSA-396x-xmvh-p563

high2026-09-24

CVE-2026-85056-ZITADEL: MFA bypass via session reuse in Login V2

View chart →

zitadel/zitadel · GHSA-9993-rfwp-rhwf

high2026-09-24

CVE-2026-85057-ZITADEL: Actions V1 sandbox escape: host file read via require()

View chart →

zitadel/zitadel · GHSA-fgmf-7rf8-m6vf

high2026-09-24

CVE-2026-62368-Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

View chart →

grokability/snipe-it · GHSA-p9h3-gvpq-5539

medium2026-09-24

CVE-2026-62286-Dozzle label filters do not restrict container event and statistics streams

View chart →

amir20/dozzle · GHSA-xcw9-qmmf-vqxj

high2026-09-24

CVE-2026-63493-Snipe-IT: 2FA bypass via the API token flow

View chart →

grokability/snipe-it · GHSA-hxcx-9h4f-42xx

medium2026-09-24

CVE-2026-19730-podman quadlet install --replace does not fully replace the old file

View chart →

podman-container-tools/podman · GHSA-fx76-2j3w-2mx6

medium2026-09-24

CVE-2026-92164-Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

View chart →

streamlink/streamlink · GHSA-vf2x-4v53-pm7v

critical2026-09-24

CVE-2026-59167-SunEditor: Critical XSS vulnerability - sanitizer bypass

View chart →

jihong88/suneditor · GHSA-6rf4-v2fh-m6p4

medium2026-09-24

CVE-2026-62998-REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

View chart →

redaxo/core · GHSA-4f5f-j737-pm58

high2026-09-23

CVE-2026-56669-elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

View chart →

elysiajs/elysia · GHSA-9643-4qgh-g8mx

high2026-09-23

CVE-2026-61685-ReactPress has SQL injection via dynamic column names in TypeORM query builders

View chart →

fecommunity/reactpress · GHSA-wmw4-mw6x-6vfm

medium2026-09-23

plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length

View chart →

plone/plone.app.contenttypes · GHSA-8pcw-h6w9-h46g

medium2026-09-23

CVE-2026-57576-plone.app.dexterity has a Denial of Service due to excessive title or description length

View chart →

plone/plone.app.dexterity · GHSA-5426-92w4-wvhv

high2026-09-23

CVE-2026-77394-OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

View chart →

openc3/cosmos · GHSA-gvf2-2rh5-mpgf