Security advisories

medium2026-01-21

CVE-2026-0895-mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport

cps-it/mailqueue · GHSA-ggff-9mj3-7246

high2026-01-21

CVE-2026-23737-seroval Affected by Remote Code Execution via JSON Deserialization

lxsmnsyc/seroval · GHSA-3rxj-6cgf-8cfw

high2026-01-21

CVE-2026-23736-seroval Affected by Prototype Pollution via JSON Deserialization

lxsmnsyc/seroval · GHSA-hj76-42vx-jwp4

critical2026-01-21

CVE-2026-23524-Laravel Redis Horizontal Scaling Insecure Deserialization

laravel/reverb · GHSA-m27r-m6rx-mhm4

high2026-01-21

CVE-2026-22444-Apache Solr: Insufficient file-access checking in standalone core-creation requests

apache/solr · GHSA-vc2w-4v3p-2mqw

high2026-01-21

CVE-2026-22022-Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin

apache/solr · GHSA-qr3p-2xj2-q7hq

low2026-01-21

CVE-2025-14083-Keycloak Admin REST API exposes backend schema and rules

keycloak/keycloak · GHSA-594w-2fwp-jwrc

medium2026-01-21

CVE-2025-14559-Keycloak services allows the issuance of access and refresh tokens for disabled users

keycloak/keycloak · GHSA-wv3h-x6c4-r867

low2026-01-21

CVE-2026-1035-Keycloak does not validate and update refresh token usage atomically

keycloak/keycloak · GHSA-m2w5-7xhv-w6fh

medium2026-01-21

CVE-2026-23952-ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load

imagemagick/imagemagick · GHSA-5vx3-wx4q-6cj8

medium2026-01-21

ImageMagick has a Memory Leak in LoadOpenCLDeviceBenchmark() when parsing malformed XML

imagemagick/imagemagick · GHSA-qp59-x883-77qv

high2026-01-21

CVE-2026-23950-Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

isaacs/node-tar · GHSA-r6q2-hw4h-h46w

medium2026-01-21

CVE-2026-23874-ImageMagick MSL: Stack overflow via infinite recursion in ProcessMSLScript

imagemagick/imagemagick · GHSA-9vj4-wc7r-p844

medium2026-01-21

CVE-2026-23886-Swift W3C TraceContext vulnerable to a malformed HTTP header causing a crash

swift-otel/swift-w3c-trace-context · GHSA-mvpq-2v8x-ww6g

medium2026-01-21

CVE-2026-23885-AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

alchemycms/alchemy_cms · GHSA-2762-657x-v979

medium2026-01-21

CVE-2026-23833-ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

esphome/esphome · GHSA-4h3h-63v6-88qx

medium2026-01-21

CVE-2026-23877-Swing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user

swingmx/swingmusic · GHSA-pj88-9xww-gxmh

medium2026-01-21

CVE-2026-23849-File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login

filebrowser/filebrowser · GHSA-43mm-m3h2-3prc

high2026-01-21

CVE-2026-23850-SiYuan vulnerable to Arbitrary file Read / SSRF

siyuan-note/siyuan · GHSA-cv54-7wv7-qxcw

high2026-01-21

CVE-2026-23851-SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality

siyuan-note/siyuan · GHSA-94c7-g2fj-7682