Security advisories

medium2026-01-27

CVE-2026-1213-askbot inexhaustive permissions check allows any user to modify a different user's profile picture

askbot/askbot-devel · GHSA-r2jv-fwfr-4j8c

medium2026-01-27

CVE-2026-24802-jsonrpc4j has Infinite Loop in RPC Stream Writer

briandilley/jsonrpc4j · GHSA-hcx3-3q5c-r5v6

medium2026-01-27

CVE-2026-24806-Quick-Media Batik Codec FIX package has Code Injection vulnerability

liuyueyi/quick-media · GHSA-8623-9fwr-4cxv

medium2026-01-27

CVE-2026-24819-weixin4j has Improperly Controlled Sequential Memory Allocation

foxinmy/weixin4j · GHSA-444m-px7r-qpvv

medium2026-01-27

CVE-2026-24807-Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec

liuyueyi/quick-media · GHSA-23f4-hfmq-94mj

high2026-01-27

oneshot has potential Use After Free when used asynchronously

faern/oneshot · GHSA-rvr2-r3pv-5m4p

medium2026-01-27

CVE-2026-24738-gmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length Values

gmrtd/gmrtd · GHSA-j49h-6577-5xwq

high2026-01-27

CVE-2026-24740-Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access

amir20/dozzle · GHSA-m855-r557-5rc5

medium2026-01-27

CVE-2026-24116-Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64

bytecodealliance/wasmtime · GHSA-vc8c-j3xm-xj73

medium2026-01-26

CVE-2026-24686-go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names

theupdateframework/go-tuf · GHSA-jqc5-w2xx-5vq4

medium2026-01-26

CVE-2026-24688-pypdf has possible Infinite Loop when processing outlines/bookmarks

py-pdf/pypdf · GHSA-2q4j-m29v-hq73

high2026-01-26

CVE-2026-24490-MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

mobsf/mobile-security-framework-mobsf · GHSA-8hf7-h89p-3pqj

critical2026-01-26

Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE

saltcorn/saltcorn · GHSA-cr3w-cw5w-h3fj

medium2026-01-26

CVE-2026-24489-Gakido vulnerable to HTTP Header Injection (CRLF Injection)

happyhackingspace/gakido · GHSA-gcgx-chcp-hxp9

high2026-01-26

CVE-2026-24486-Python-Multipart has Arbitrary File Write via Non-Default Configuration

kludex/python-multipart · GHSA-wp53-j4wj-2cfg

high2026-01-26

CVE-2026-24470-Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName

zalando/skipper · GHSA-mxxc-p822-2hx9

low2026-01-26

CVE-2026-24408-sigstore CSRF possibility in OIDC authentication during signing

sigstore/sigstore-python · GHSA-hm8f-75xx-w2vr

high2026-01-26

CVE-2026-24400-AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion

assertj/assertj · GHSA-rqfh-9r24-8c9r

medium2026-01-26

CVE-2025-14969-Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion

hibernate/hibernate-reactive · GHSA-frpp-8pwq-hjrx

medium2026-01-26

CVE-2025-11687-GI-DocGen vulnerable to Reflected XSS via unescaped query strings

gnome/gi-docgen · GHSA-6p6h-rqr6-62mv