Security advisories

medium2026-01-28

TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)

microsoft/taskweaver · GHSA-gpx9-96j6-pp87

high2026-01-28

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

vercel/next.js · GHSA-h25m-26qc-wcjf

medium2026-01-28

CVE-2025-59472-Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

vercel/next.js · GHSA-5f7q-jpqc-wp7h

high2026-01-28

CVE-2026-1513-billboard.js is vulnerable to XSS during chart option binding

naver/billboard.js · GHSA-rpc5-pm7q-hjmp

medium2026-01-28

CVE-2026-24909-vlt Mishandles Path Sanitization for tar

vltpkg/vltpkg · GHSA-gf2c-jwcj-x929

high2026-01-27

CVE-2026-24765-PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

sebastianbergmann/phpunit · GHSA-vvj3-c3rp-c85p

medium2026-01-27

CVE-2026-24748-Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access

akuity/kargo · GHSA-w5wv-wvrp-v5m5

medium2026-01-27

CVE-2026-24134-StudioCMS has Authorization Bypass Through User-Controlled Key

withstudiocms/studiocms · GHSA-8cw6-53m5-4932

high2026-01-27

CVE-2026-24747-PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files

pytorch/pytorch · GHSA-63cw-57p8-fm3p

critical2026-01-27

CVE-2026-23830-SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor

nyariv/sandboxjs · GHSA-wxhw-j4hc-fmq6

medium2026-01-27

CVE-2025-59471-Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration

vercel/next.js · GHSA-9g9p-9gw9-jx7f

medium2026-01-27

CVE-2026-24473-Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

honojs/hono · GHSA-w332-q679-j88p

medium2026-01-27

CVE-2026-24472-Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

honojs/hono · GHSA-6wqw-2p9w-4vw4

medium2026-01-27

CVE-2026-24398-Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

honojs/hono · GHSA-r354-f388-2fhh

medium2026-01-27

CVE-2026-23892-OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication

octoprint/octoprint · GHSA-xg4x-w2j3-57h6

high2026-01-27

CVE-2020-36947-LibreNMS contains an authenticated SQL Injection vulnerability

librenms/librenms · GHSA-qp2j-v5jg-hg68

high2026-01-27

CVE-2020-36939-Cassandra Web - Remote File Read

avalanche123/cassandra-web · GHSA-8mfv-xhp5-48q9

high2026-01-27

CVE-2026-23881-Kyverno Denial of Service via Context Variable Amplification in Policy Engine

kyverno/kyverno · GHSA-r2rj-wwm5-x6mq

critical2026-01-27

CVE-2026-22039-Kyverno Cross-Namespace Privilege Escalation via Policy apiCall

kyverno/kyverno · GHSA-8p9x-46gm-qfx2

critical2026-01-27

CVE-2026-1470-n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution

n8n-io/n8n · GHSA-5xrp-6693-jjx9