Security advisories

high2026-01-20

CVE-2026-22031-Fastify Middie Middleware Path Bypass

fastify/middie · GHSA-cxrg-g7r8-w69p

high2026-01-20

CVE-2026-21696-Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered

pterodactyl/wings · GHSA-2497-gp99-2m74

high2026-01-20

CVE-2025-69199-Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks

pterodactyl/panel · GHSA-8w7m-w749-rx98

medium2026-01-20

CVE-2025-69198-Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted

pterodactyl/panel · GHSA-jw2v-cq5x-q68g

high2026-01-20

CVE-2025-68616-WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

kozea/weasyprint · GHSA-983w-rhvv-gwmv

medium2026-01-20

CVE-2026-1180- Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF)

keycloak/keycloak · GHSA-7vw6-5q2f-7w5r

low2026-01-20

CVE-2026-1196-MineAdmin May Expose Sensitive Information to an Unauthorized Actor

mineadmin/mineadmin · GHSA-wq8p-q8cq-94w5

low2026-01-20

CVE-2026-1195-MineAdmin improperly refreshes tokens

mineadmin/mineadmin · GHSA-43rr-x62x-q96w

high2026-01-20

CVE-2026-22219-Chainlit contain a server-side request forgery (SSRF) vulnerability

chainlit/chainlit · GHSA-2g59-m95p-pgfq

medium2026-01-20

CVE-2026-1194-MineAdmin May Expose Sensitive Information to an Unauthorized Actor

mineadmin/mineadmin · GHSA-7f7m-83r3-p644

low2026-01-20

CVE-2026-1193-MineAdmin has Incorrect Privilege Assignment

mineadmin/mineadmin · GHSA-23hh-2f47-3p4h

medium2026-01-19

CVE-2025-59355-Apache Linkis: Password Exposure

apache/linkis · GHSA-6vfr-p2hx-6v32

high2026-01-19

CVE-2025-29847-Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass

apache/linkis · GHSA-c399-q49h-qwc8

low2026-01-18

CVE-2025-15536-Open Chinese Convert has Out-of-bounds Write

byvoid/opencc · GHSA-5pr6-crvp-2j9f

medium2026-01-17

CVE-2026-1050-risesoft-y9 Digital-Infrastructure has a SQL injection vulnerability

risesoft-y9/digital-infrastructure · GHSA-vhcx-7rpg-hp39

high2026-01-16

CVE-2026-23745-node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

isaacs/node-tar · GHSA-8qq5-rm4j-mr97

critical2026-01-16

CVE-2026-23744-REC in MCPJam inspector due to HTTP Endpoint exposes

mcpjam/inspector · GHSA-232v-j27c-5pp6

high2026-01-16

CVE-2026-23735-GraphQL Modules has a Race Condition issue

graphql-hive/graphql-modules · GHSA-53wg-r69p-v3r7

medium2026-01-16

Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM

decentralized-identity/veramo · GHSA-38cw-85xc-xr9x

high2026-01-16

CVE-2026-23742-Skipper is vulnerable to arbitrary code execution through lua filters

zalando/skipper · GHSA-cc8m-98fm-rc9g