Security advisories

low2026-01-21

CVE-2026-24048-Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`

backstage/backstage · GHSA-q2x5-4xjx-c6p9

medium2026-01-21

CVE-2026-24047-@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass

backstage/backstage · GHSA-2p49-45hj-7mc9

high2026-01-21

CVE-2026-24046-Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

backstage/backstage · GHSA-rq6q-wr2q-7pgp

low2026-01-21

CVE-2026-23996-FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection

athroniaeth/fastapi-api-key · GHSA-95c6-p277-p87g

medium2026-01-21

CVE-2026-23990-Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

controlplaneio-fluxcd/flux-operator · GHSA-4xh5-jcj2-ch8q

medium2026-01-21

CVE-2026-23986-Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true

copier-org/copier · GHSA-4fqp-r85r-hxqh

medium2026-01-21

CVE-2026-23968-Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false

copier-org/copier · GHSA-xjhm-gp88-8pfx

high2026-01-21

CVE-2026-23960-Argo Workflows affected by stored XSS in the artifact directory listing

argoproj/argo-workflows · GHSA-cv78-6m8q-ph82

high2026-01-21

CVE-2021-47853-phpPgAdmin contains a remote command execution vulnerability

phppgadmin/phppgadmin · GHSA-86gh-c8r8-xwhq

high2026-01-21

CVE-2026-23957-Seroval affected by Denial of Service via Array serialization

lxsmnsyc/seroval · GHSA-66fc-rw6m-c2q6

high2026-01-21

CVE-2026-23956-seroval affected by Denial of Service via RegExp serialization

lxsmnsyc/seroval · GHSA-hx9m-jf43-8ffr

medium2026-01-21

CVE-2026-23946-Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization

tendenci/tendenci · GHSA-339m-4qw5-j2g3

high2026-01-21

@envelop/graphql-modules has a Race Condition vulnerability

graphql-hive/envelop · GHSA-h3hw-29fv-2x75

medium2026-01-21

CVE-2026-23992-go-tuf improperly validates the configured threshold for delegations

theupdateframework/go-tuf · GHSA-fphv-w9fq-2525

medium2026-01-21

CVE-2026-23991-go-tuf affected by client DoS via malformed server response

theupdateframework/go-tuf · GHSA-846p-jg2w-w324

high2026-01-21

CVE-2026-23965-sm-crypto Affected by Signature Forgery in SM2-DSA

juneandgreen/sm-crypto · GHSA-hpwg-xg7m-3p6m

high2026-01-21

CVE-2026-23967-sm-crypto Affected by Signature Malleability in SM2-DSA

juneandgreen/sm-crypto · GHSA-qv7w-v773-3xqm

critical2026-01-21

CVE-2026-23966-sm-crypto Affected by Private Key Recovery in SM2-PKE

juneandgreen/sm-crypto · GHSA-pgx9-497m-6c4v

medium2026-01-21

CVE-2026-23959-CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier

coreshop/coreshop · GHSA-fqcv-8859-86x2

high2026-01-21

CVE-2026-22807-vLLM affected by RCE via auto_map dynamic module loading during model initialization

vllm-project/vllm · GHSA-2pc9-4j83-qjmr