Security advisories

critical2026-01-30

CVE-2026-25141-Orval has Code Injection via unsanitized x-enum-descriptions using JS comments

orval-labs/orval · GHSA-gch2-phqh-fg9q

critical2026-01-30

CVE-2026-25130-CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection

aliasrobotics/cai · GHSA-jfpc-wj3m-qw2m

high2026-01-30

CVE-2026-25128-fast-xml-parser has RangeError DoS Numeric Entities Bug

naturalintelligence/fast-xml-parser · GHSA-37qj-frw5-hhjh

low2026-01-30

CVE-2026-25050-Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

vendurehq/vendure · GHSA-6f65-4fv2-wwch

high2026-01-30

CVE-2024-4027-Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names

undertow-io/undertow · GHSA-33hj-rcmx-86mv

medium2026-01-30

CVE-2026-24687-Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac

umbraco/umbraco.forms.issues · GHSA-hm5p-82g6-m3xh

low2026-01-30

CVE-2026-25211-Llama Stack exposes secret in initialization log

llamastack/llama-stack · GHSA-xmfj-7pp5-fxr6

critical2026-01-29

CVE-2026-25047-deepHas vulnerable to Prototype Pollution via constructor.prototype

sharpred/deephas · GHSA-2733-6c58-pf27

medium2026-01-29

CVE-2026-24846-malcontent vulnerable to symlink Path Traversal via handleSymlink argument confusion in archive extraction

chainguard-dev/malcontent · GHSA-923j-vrcg-hxwh

medium2026-01-29

CVE-2026-24845-malcontent OCI image pull credential exfiltration via malicious registry token realm

chainguard-dev/malcontent · GHSA-9m43-p3cx-w8j5

critical2026-01-29

Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)

obsidianforensics/unfurl · GHSA-vg9h-jx4v-cwx2

high2026-01-29

CVE-2026-40036-Unfurl's unbounded zlib decompression allows decompression bomb DoS

obsidianforensics/unfurl · GHSA-h5qv-qjv4-pc5m

low2026-01-29

CVE-2026-1237-Juju has broken CMR authorization

juju/juju · GHSA-j477-6vpg-6c8x

medium2026-01-29

CVE-2026-24888-Maker.js has Unsafe Property Copying in makerjs.extendObject

microsoft/maker.js · GHSA-2cp6-34r9-54xx

critical2026-01-29

CVE-2026-25539-SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

siyuan-note/siyuan · GHSA-c4jr-5q7w-f6r9

high2026-01-29

CVE-2026-24780-AutoGPT is Vulnerable to RCE via Disabled Block Execution

significant-gravitas/autogpt · GHSA-r277-3xc5-c79v

high2026-01-29

CVE-2026-23864-React Server Components have multiple Denial of Service Vulnerabilities

facebook/react · GHSA-83fc-fqcc-2hmg

high2026-01-28

CVE-2026-25992-SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal

siyuan-note/siyuan · GHSA-f72r-2h5j-7639

medium2026-01-28

CVE-2026-24889-soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64

stellar/rs-soroban-sdk · GHSA-96xm-fv9w-pf3f

medium2026-01-28

CVE-2026-24766-NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS

nocodb/nocodb · GHSA-95ff-46g6-6gw9