Security advisories

medium2026-01-28

CVE-2026-24767-NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality

nocodb/nocodb · GHSA-xr7v-j379-34v9

medium2026-01-28

CVE-2026-24768-NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter

nocodb/nocodb · GHSA-3hmw-8mw3-rmpj

high2026-01-28

CVE-2026-24769-NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

nocodb/nocodb · GHSA-q5c6-h22r-qpwr

critical2026-01-28

CVE-2026-24838-DotNetNuke.Core Vulnerable to Stored XSS via Module Title

dnnsoftware/dnn.platform · GHSA-w9pf-h6m6-v89h

medium2026-01-28

CVE-2026-24739-Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows

symfony/symfony · GHSA-r39x-jcww-82v6

high2026-01-28

CVE-2026-22243-EGroupware has SQL Injection in Nextmatch Filter Processing

egroupware/egroupware · GHSA-rvxj-7f72-mhrx

medium2026-01-28

CVE-2020-36962-Tendenci is Vulnerable to CSV Formula Injection through its Contact Form Message Field

tendenci/tendenci · GHSA-4q3w-jgfx-4792

medium2026-01-28

CVE-2025-57283-BrowserStack Local vulnerable to Command Injection through logfile variable

browserstack/browserstack-local-nodejs · GHSA-g4w6-c99w-4wh7

medium2026-01-28

CVE-2025-61140-JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js

dchester/jsonpath · GHSA-6c59-mwgh-r2x6

medium2026-01-28

CVE-2026-24850-ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices

rustcrypto/signatures · GHSA-5x2r-hc65-25f9

high2026-01-28

CVE-2026-24842-node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

isaacs/node-tar · GHSA-34x7-hfp2-rc4v

high2026-01-28

CVE-2026-24837-DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

dnnsoftware/dnn.platform · GHSA-vm5q-8qww-h238

high2026-01-28

CVE-2026-24836-DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

dnnsoftware/dnn.platform · GHSA-2g5g-hcgh-q3rp

high2026-01-28

CVE-2026-24785-Clatter has a PSK Validity Rule Violation issue

jmlepisto/clatter · GHSA-253q-9q78-63x4

medium2026-01-28

CVE-2026-24784-DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer

dnnsoftware/dnn.platform · GHSA-jjwg-4948-6wxp

high2026-01-28

CVE-2026-24783-soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives

script3/soroban-fixed-point-math · GHSA-x5m4-43jf-hh65

high2026-01-28

CVE-2026-24779-vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector

vllm-project/vllm · GHSA-qh4c-xf7m-gxfc

high2026-01-28

CVE-2026-24778-Ghost vulnerable to XSS via malicious Portal preview links

tryghost/ghost · GHSA-gv6q-2m97-882h

medium2026-01-28

CVE-2026-24771-Hono vulnerable to XSS through ErrorBoundary component

honojs/hono · GHSA-9r54-q6cx-xmh5

critical2026-01-28

Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema

capnproto/capnproto-rust · GHSA-5w5r-mf82-595p