Security advisories

medium2026-02-03

CVE-2026-25537-jsonwebtoken has Type Confusion that leads to potential authorization bypass

keats/jsonwebtoken · GHSA-h395-gr6q-cpjc

high2026-02-03

CVE-2025-69213-OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)

devcode-it/openstamanager · GHSA-w995-ff8h-rppg

medium2026-02-03

CVE-2026-1664-Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing

cloudflare/agents · GHSA-r7x9-8ph7-w8cg

medium2026-02-03

CVE-2026-25517-Wagtail has improper permission handling on admin preview endpoints

wagtail/wagtail · GHSA-4qvv-g3vr-m348

high2026-02-03

CVE-2025-69970-FUXA contains an insecure default configuration vulnerability

frangoteam/fuxa · GHSA-r5m2-fqcf-qrf7

low2026-02-03

CVE-2025-70849-Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)

stefanprodan/podinfo · GHSA-mw8w-q3f7-2v85

high2026-02-03

CVE-2025-70560-Boltz contains an insecure deserialization vulnerability in its molecule loading functionality

jwohlwend/boltz · GHSA-fjm6-8xp2-4fwc

high2026-02-03

CVE-2025-69981-FUXA contains an Unrestricted File Upload vulnerability

frangoteam/fuxa · GHSA-7g56-fwxj-cm23

high2026-02-03

CVE-2025-69983-FUXA allows Remote Code Execution (RCE) via the project import functionality.

frangoteam/fuxa · GHSA-5r63-q8hg-p8qx

medium2026-02-03

CVE-2026-23794-Apache Syncope: Reflected XSS on Enduser Login

apache/syncope · GHSA-v84m-gfw5-hm2w

medium2026-02-03

CVE-2026-23795-Apache Syncope: Console XXE on Keymaster parameters

apache/syncope · GHSA-73f3-rqqf-2j54

high2026-02-03

CVE-2026-25514-FacturaScripts has SQL Injection in Autocomplete Actions

neorazorx/facturascripts · GHSA-pqqg-5f4f-8952

high2026-02-03

CVE-2026-25513-FacturaScripts has SQL Injection in API ORDER BY Clause

neorazorx/facturascripts · GHSA-cjfx-qhwm-hf99

critical2026-02-03

CVE-2026-25526-JinJava Bypass through ForTag leads to Arbitrary Java Execution

hubspot/jinjava · GHSA-gjx9-j8f8-7j74

critical2026-02-03

CVE-2025-64712-Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write

unstructured-io/unstructured · GHSA-gm8q-m8mv-jj5m

high2026-02-03

CVE-2026-24884-Compressing Vulnerable to Arbitrary File Write via Symlink Extraction

node-modules/compressing · GHSA-cc8f-xg8v-72m3

medium2026-02-03

CVE-2026-24762-RustFS Logs Sensitive Credentials in Plaintext

rustfs/rustfs · GHSA-r54g-49rx-98cr

high2026-02-03

CVE-2026-21862-RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

rustfs/rustfs · GHSA-fc6g-2gcp-2qrq

high2026-02-03

CVE-2025-65017-Decidim's private data exports can lead to data leaks

decidim/decidim · GHSA-3cx6-j9j4-54mp

high2026-02-03

CVE-2026-1287-Django has an SQL Injection issue

django/django · GHSA-gvg8-93h5-g6qq