Security advisories

medium2026-01-22

CVE-2026-23831-Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message

sigstore/rekor · GHSA-273p-m2cw-6833

high2026-01-22

CVE-2026-1260-Sentencepiece has a a heap overflow issue

google/sentencepiece · GHSA-38vq-g6vr-w8wf

high2026-01-22

CVE-2025-67221-orjson does not limit recursion for deeply nested JSON documents

ijl/orjson · GHSA-hx9q-6w63-j58v

medium2026-01-22

CVE-2025-69820-Beam Exposes sensitive information via joinCleanPath function

beam-cloud/beta9 · GHSA-73jg-4qh6-3f4g

high2026-01-22

CVE-2026-24132-Orval Mock Generation Code Injection via const

orval-labs/orval · GHSA-f456-rf33-4626

low2026-01-22

CVE-2026-24130-Moonraker affected by LDAP search filter injection

arksine/moonraker · GHSA-3jqf-v4mv-747g

high2026-01-22

SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions

surrealdb/surrealdb · GHSA-3v2x-9xcv-2v2v

low2026-01-22

Umbraco.Forms CDN may cache sensitive form uploads when processed by ImageSharp

umbraco/umbraco.forms.issues · GHSA-7jxj-rpx7-ph2c

high2026-01-22

CVE-2026-24124-Dragonfly Manager Job API Unauthenticated Access

dragonflyoss/dragonfly · GHSA-j8hf-cp34-g4j7

high2026-01-22

CVE-2026-24049-Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

pypa/wheel · GHSA-8rrh-rw8j-w5fx

high2026-01-22

CVE-2026-24009-docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage

docling-project/docling-core · GHSA-vqxf-v2gg-x3hc

high2026-01-22

CVE-2026-24006-Seroval affected by Denial of Service via Deeply Nested Objects

lxsmnsyc/seroval · GHSA-3j22-8qj3-26mx

high2026-01-22

CVE-2025-65098-Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass

baptistearno/typebot.io · GHSA-4xc5-wfwc-jw47

low2026-01-22

CVE-2026-1225-Logback allows an attacker to instantiate classes already present on the class path

qos-ch/logback · GHSA-qqpg-mvqg-649v

medium2026-01-22

CVE-2025-71176-pytest has vulnerable tmpdir handling

pytest-dev/pytes · GHSA-6w46-j5rx-g56g

high2026-01-21

CVE-2026-24058-Soft Serve Affected by an Authentication Bypass

charmbracelet/soft-serve · GHSA-pchf-49fh-w34r

medium2026-01-21

CVE-2025-13465-Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions

lodash/lodash · GHSA-xxjr-mmjv-4gpg

high2026-01-21

CVE-2026-0933-Wrangler affected by OS Command Injection in `wrangler pages deploy`

cloudflare/workers-sdk · GHSA-36p8-mvp6-cv38

low2026-01-21

OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format

opentofu/opentofu · GHSA-r92c-9c7f-3pj8

low2026-01-21

Triton VM has a Soundness Vulnerability due to Improper Sampling of Randomness

tritonvm/triton-vm · GHSA-rjr4-v43m-pxq6