Security advisories

high2026-09-23

CVE-2026-82407-Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

View chart →

klever-io/klever-go · GHSA-9wh6-9hq7-9688

high2026-09-23

CVE-2026-82409-Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

View chart →

klever-io/klever-go · GHSA-7c7c-373r-gfjj

high2026-09-23

CVE-2026-82406-Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

View chart →

klever-io/klever-go · GHSA-26r5-4mm2-px5c

high2026-09-23

CVE-2026-76089-Formie: Missing authorization on sent notification resend modal exposes submission PII

View chart →

verbb/formie · GHSA-9rg8-2wvr-fgjh

high2026-09-23

CVE-2026-61814-Jawn: Quadratic parsing effort in AsyncParser

View chart →

typelevel/jawn · GHSA-w4cm-gvhj-cgw6

high2026-09-23

CVE-2026-59990-Jawn: Uncontrolled nesting depth in JSON parser

View chart →

typelevel/jawn · GHSA-cc4v-rvgp-2pf3

high2026-09-23

CVE-2026-82405-Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

View chart →

klever-io/klever-go · GHSA-97cv-x867-6xhm

high2026-09-23

CVE-2026-86065-Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

View chart →

klever-io/klever-go · GHSA-4fwh-wrm6-97xm

high2026-09-23

CVE-2026-86064-Klever-Go: /log controls global node logging

View chart →

klever-io/klever-go · GHSA-9v8p-frvj-2pcm

medium2026-09-23

CVE-2026-93421-Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

View chart →

mesop-dev/mesop · GHSA-g7f6-rxc4-qhph

critical2026-09-23

CVE-2026-77602-OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

View chart →

openc3/cosmos · GHSA-jjq7-m736-w977

high2026-09-23

CVE-2026-77601-OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

View chart →

openc3/cosmos · GHSA-vp3w-52v9-q57f

high2026-09-23

CVE-2026-61695-Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

View chart →

square/wire · GHSA-86wm-r4c5-2rc9

high2026-09-23

CVE-2026-76087-Formie: Unauthenticated users can overwrite incomplete submissions via submit action

View chart →

verbb/formie · GHSA-584p-f93j-wpgc

high2026-09-23

CVE-2026-76086-Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

View chart →

verbb/formie · GHSA-v3f3-cmj4-cvj9

medium2026-09-23

CVE-2026-92692-Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

View chart →

sulu/sulu · GHSA-jg26-q8hg-3pq4

medium2026-09-23

CVE-2026-77421-JLine: ReDoS in Nano Editor Regex Search Mode

View chart →

jline/jline3 · GHSA-ph9c-7hw9-vhhw

high2026-09-23

CVE-2026-77422-JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

View chart →

jline/jline3 · GHSA-r2xf-8xr9-62gw

high2026-09-23

CVE-2026-56679-9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

View chart →

decolua/9router · GHSA-vmjq-hvgq-2wv4

medium2026-09-23

CVE-2026-56678-9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

View chart →

decolua/9router · GHSA-6mwv-4mrm-5p3m