Security advisories

critical2026-02-02

CVE-2026-25505-Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication

maziggy/bambuddy · GHSA-gc24-px2r-5qmf

medium2026-02-02

WireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow

h44z/wg-portal · GHSA-grh9-37g7-53mj

medium2026-02-02

picklescan vulnerable to arbitrary file create using logging.FileHandler

mmaitre314/picklescan · GHSA-m7j5-r2p5-c39r

high2026-02-02

CVE-2026-53874-picklescan missing detection by simple obfuscation of a `builtins.eval` call

mmaitre314/picklescan · GHSA-9m3x-qqw2-h32h

critical2026-02-02

CVE-2026-25481-Langroid has WAF Bypass Leading to RCE in TableChatAgent

langroid/langroid · GHSA-x34r-63hx-w57f

medium2026-02-02

ml-dsa's UseHint function has off by two error when r0 equals zero

rustcrypto/signatures · GHSA-h37v-hp6w-2pp8

high2026-02-02

CVE-2026-25499-terraform-provider-proxmox has insecure sudo recommendation in the documentation

bpg/terraform-provider-proxmox · GHSA-gwch-7m8v-7544

high2026-02-02

CVE-2026-25153-@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks

backstage/backstage · GHSA-6jr7-99pf-8vgf

critical2026-02-02

CVE-2026-25142-SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE

nyariv/sandboxjs · GHSA-9p4w-fq8m-2hp7

high2026-02-02

CVE-2026-25060-OpenList has Insecure TLS Default Configuration

openlistteam/openlist · GHSA-wf93-3ghh-h389

high2026-02-02

CVE-2026-24051-OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

open-telemetry/opentelemetry-go · GHSA-9h8m-3fm2-qjrq

high2026-02-02

CVE-2026-25059-OpenList vulnerable to Path Traversal in file copy and remove handlers

openlistteam/openlist · GHSA-qmj2-8r24-xxcq

medium2026-02-02

CVE-2026-1770-Crafter CMS has Improper Control of Dynamically-Managed Code Resources

craftercms/craftercms · GHSA-gj28-gw7w-3pxc

high2026-02-02

CVE-2026-24737-jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution

parallax/jspdf · GHSA-pqxr-3g65-p328

high2026-02-02

CVE-2026-24133-jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder

parallax/jspdf · GHSA-95fx-jjr5-f39c

medium2026-02-02

CVE-2026-24043-jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)

parallax/jspdf · GHSA-vm32-vv63-w422

medium2026-02-02

CVE-2026-24040-jsPDF has Shared State Race Condition in addJS Plugin

parallax/jspdf · GHSA-cjw8-79x6-5cj4

high2026-02-02

CVE-2026-23997-FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View

neorazorx/facturascripts · GHSA-4v7v-7v7r-3r5h

critical2026-02-02

CVE-2026-23515-Signal K set-system-time plugin vulnerable to RCE - Command Injection

signalk/signalk-server · GHSA-p8gp-2w28-mhwg

medium2026-02-02

CVE-2026-23476-FacturaScripts is Vulnerable to Reflected XSS

neorazorx/facturascripts · GHSA-g6w2-q45f-xrp4