Security advisories

high2026-01-16

svelte is vulnerable to XSS with textarea bind:value

sveltejs/svelte · GHSA-gw32-9rmw-qwww

medium2026-01-16

CVE-2026-23643-CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

cakephp/cakephp · GHSA-qh8m-9qxx-53m5

critical2026-01-16

CVE-2026-26216-Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter

unclecode/crawl4ai · GHSA-5882-5rx9-xgxp

critical2026-01-16

CVE-2026-26217-Crawl4AI Has Local File Inclusion in Docker API via file:// URLs

unclecode/crawl4ai · GHSA-vx9w-5cx4-9796

medium2026-01-16

CVE-2026-23645-SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File Upload

siyuan-note/siyuan · GHSA-pcjq-j3mq-jv5j

medium2026-01-16

Active Job - Object injection security vulnerability

rails/rails · GHSA-mpwp-4h2m-765c

high2026-01-16

ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection

jruby/activerecord-jdbc-adapter · GHSA-5qw5-wf2q-f538

high2026-01-16

CVE-2026-23490-pyasn1 has a DoS vulnerability in decoder

pyasn1/pyasn1 · GHSA-63vm-454h-vhhq

high2026-01-16

CVE-2026-23535-Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command

weblateorg/wlc · GHSA-mmwx-79f6-67jg

medium2026-01-16

CVE-2026-23528-Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard

dask/distributed · GHSA-c336-7962-wfj2

high2026-01-16

CVE-2026-22864-Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

denoland/deno · GHSA-m3c4-prhw-mrx6

critical2026-01-16

CVE-2026-22863-Deno node:crypto doesn't finalize cipher

denoland/deno · GHSA-5379-f5hf-w38v

low2026-01-16

CVE-2026-22782-RustFS's RPC signature verification logs shared secret

rustfs/rustfs · GHSA-333v-68xh-8mmq

medium2026-01-16

CVE-2025-15104-Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability

validator/validator · GHSA-fccg-7w3p-w66f

high2026-01-16

CVE-2025-14894-Livewire Filemanager does not restrict uploaded file types

livewire-filemanager/filemanager · GHSA-9g95-48c6-r778

medium2026-01-16

CVE-2025-14435-Mattermost is vulnerable to DoS due to infinite re-renders on API errors

mattermost/mattermost · GHSA-mx8m-v8qm-xwr8

high2026-01-16

CVE-2025-68675-Apache Airflow proxy credentials for various providers might leak in task logs

apache/airflow · GHSA-7c2f-r6gc-h92h

high2026-01-16

CVE-2025-68438-Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated

apache/airflow · GHSA-3qmm-r55x-hpxx

low2026-01-16

CVE-2025-14822-Mattermost is vulnerable to CPU exhaustion via crafted HTTP request

mattermost/mattermost · GHSA-9r42-rhw3-2222

low2026-01-16

CVE-2026-0858-PlantUML is vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams

plantuml/plantuml · GHSA-hrvf-g648-rf3m