Security advisories

medium2026-01-21

CVE-2026-23845-Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API

axllent/mailpit · GHSA-6jxm-fv7w-rw5j

critical2026-01-21

CVE-2026-23947-Orval has a code injection via unsanitized x-enum-descriptions in enum generation

orval-labs/orval · GHSA-h526-wf6g-67jv

low2026-01-21

CVE-2026-23847-SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

siyuan-note/siyuan · GHSA-w836-5gpm-7r93

medium2026-01-21

CVE-2026-21852-Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

anthropics/claude-code · GHSA-jh7p-qr78-84p7

medium2026-01-20

CVE-2026-1245-binary-parser library has a code injection vulnerability

keichi/binary-parser · GHSA-m39p-34qh-rh3w

critical2026-01-20

CVE-2026-23518-Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

fleetdm/fleet · GHSA-63m5-974w-448v

high2026-01-20

CVE-2026-23517-Fleet has an Access Control vulnerability in debug/pprof endpoints

fleetdm/fleet · GHSA-4r5r-ccr6-q6f6

medium2026-01-20

CVE-2026-22808-Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

fleetdm/fleet · GHSA-gfpw-jgvr-cw4j

low2026-01-20

CVE-2025-66803-Turbo Frame responses can restore stale session cookies

hotwired/turbo · GHSA-qppm-g56g-fpvp

high2026-01-20

CVE-2026-23842-ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion

gunthercox/chatterbot · GHSA-v4w8-49pv-mf72

critical2026-01-20

CVE-2025-64087-XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability

opensagres/xdocreport · GHSA-r8w2-w357-9pjv

critical2026-01-20

CVE-2025-65482-XDocReport affected by an XML External Entity (XXE) vulnerability

opensagres/xdocreport · GHSA-7jc7-g598-2p64

medium2026-01-20

CVE-2026-23829-Mailpit has an SMTP Header Injection via Regex Bypass

axllent/mailpit · GHSA-54wq-72mp-cq7c

critical2026-01-20

CVE-2026-23733-Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)

lobehub/lobe-chat · GHSA-4gpc-rhpj-9443

medium2026-01-20

CVE-2026-22770-ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

imagemagick/imagemagick · GHSA-39h3-g67r-7g3c

high2026-01-20

CVE-2026-23644-esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages

esm-dev/esm.sh · GHSA-2657-3c98-63jq

low2026-01-20

CVE-2026-23522-Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

lobehub/lobe-chat · GHSA-j7xp-4mg9-x28r

medium2026-01-20

CVE-2026-23626-Kimai has an Authenticated Server-Side Template Injection (SSTI)

kimai/kimai · GHSA-jg2j-2w24-54cg

critical2026-01-20

CVE-2026-22822-External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

external-secrets/external-secrets · GHSA-77v3-r3jw-j2v2

high2026-01-20

CVE-2026-22037-@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)

fastify/fastify-express · GHSA-g6q3-96cp-5r5m