Security advisories

medium2026-02-04

CVE-2026-25145-melange has a path traversal in license-path which allows reading files outside workspace

chainguard-dev/melange · GHSA-2w4f-9fgg-q2v9

high2026-02-04

CVE-2026-25143-melange affected by potential host command execution via license-check YAML mode patch pipeline

chainguard-dev/melange · GHSA-rf4g-89h5-crcr

high2026-02-04

CVE-2026-25140-apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams

chainguard-dev/apko · GHSA-f4w5-5xv9-85f6

medium2026-02-03

CVE-2026-25122-apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

chainguard-dev/apko · GHSA-6p9p-q6wh-9j89

high2026-02-03

CVE-2026-25121-apko has a path traversal in apko dirFS which allows filesystem writes outside base

chainguard-dev/apko · GHSA-5g94-c2wx-8pxw

high2026-02-03

CVE-2026-24844-melange pipeline working-directory could allow command injection

chainguard-dev/melange · GHSA-vqqr-rmpc-hhg2

high2026-02-03

CVE-2026-24843-melange QEMU runner could write files outside workspace directory

chainguard-dev/melange · GHSA-qxx2-7h4c-83f4

medium2026-02-03

CVE-2026-25597-PrestaShop affected by time based enumeration in FO login form

prestashop/prestashop · GHSA-67v7-3g49-mxh2

medium2026-02-03

CVE-2026-25155-Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

qwikdev/qwik · GHSA-vm6g-8r4h-22x8

low2026-02-03

CVE-2026-25149-Qwik City Open Redirect via fixTrailingSlash

qwikdev/qwik · GHSA-92j7-wgmg-f32m

medium2026-02-03

CVE-2026-25151-Qwik City has a CSRF Protection Bypass via Content-Type Header Validation

qwikdev/qwik · GHSA-r666-8gjf-4v5f

critical2026-02-03

CVE-2026-25150-Prototype Pollution via FormData Processing in Qwik City

qwikdev/qwik · GHSA-xqg6-98cw-gxhq

medium2026-02-03

CVE-2026-25148-Qwik SSR XSS via Unsafe Virtual Node Serialization

qwikdev/qwik · GHSA-m6jq-g7gq-5w3c

high2026-02-03

CVE-2026-25547-@isaacs/brace-expansion has Uncontrolled Resource Consumption

isaacs/brace-expansion · GHSA-7h2j-956f-4vf2

high2026-02-03

CVE-2026-24887-Claude Code has a Command Injection in find Command Bypasses User Approval Prompt

anthropics/claude-code · GHSA-qgqw-h4xq-7w8w

high2026-02-03

CVE-2026-24053-Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes

anthropics/claude-code · GHSA-q728-gf8j-w49r

medium2026-02-03

CVE-2026-25543-HtmlSanitizer has a bypass via template tag

mganss/htmlsanitizer · GHSA-j92c-7v7g-gj3f

medium2026-02-03

CVE-2026-25541-bytes has integer overflow in BytesMut::reserve

tokio-rs/bytes · GHSA-434x-w66g-qw3r

high2026-02-03

CVE-2026-24052-Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

anthropics/claude-code · GHSA-vhw5-3g5m-8ggf

high2026-02-03

CVE-2025-69215-OpenSTAManager has an SQL Injection in the Stampe Module

devcode-it/openstamanager · GHSA-qx9p-w3vj-q24q