Security advisories

medium2026-01-15

CVE-2026-22045-Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

traefik/traefik · GHSA-cwjm-3f7h-9hwq

low2026-01-15

solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets

solspace/craft-freeform · GHSA-rwr8-xrpw-9qf5

low2026-01-15

solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data

solspace/craft-freeform · GHSA-44jg-mv3h-wj6g

high2026-01-15

CVE-2026-22775-devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

sveltejs/devalue · GHSA-g2pg-6438-jwpf

medium2026-01-15

CVE-2026-1002-Vert.x Web static handler component cache can be manipulated to deny the access to static files

eclipse-vertx/vert.x · GHSA-cphf-4846-3xx9

medium2026-01-15

CVE-2025-68671-lakeFS is Missing Timestamp Validation in S3 Gateway Authentication

treeverse/lakefs · GHSA-f2ph-gc9m-q55f

low2026-01-15

CVE-2026-23634-Pepr Has Overly Permissive RBAC ClusterRole in Admin Mode

defenseunicorns/pepr · GHSA-w54x-r83c-x79q

medium2026-01-15

CVE-2025-15265-svelte vulnerable to Cross-site Scripting

sveltejs/svelte · GHSA-6738-r8g5-qwp3

low2026-01-15

solspace/craft-freeform Has a DoS Vulnerability

solspace/craft-freeform · GHSA-58q2-9x27-h2jm

high2026-01-15

CVE-2026-23622-alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass

alextselegidis/easyappointments · GHSA-54v4-4685-vwrj

high2026-01-15

CVE-2026-23527-h3 v1 has Request Smuggling (TE.TE) issue

h3js/h3 · GHSA-mp2g-9vg9-f4cg

critical2026-01-15

CVE-2026-23520-Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE

getarcaneapp/arcane · GHSA-gjqq-6r35-w3r8

medium2026-01-15

CVE-2021-47776-Umbraco CMS contains a server-side request forgery vulnerability

umbraco/umbraco-cms · GHSA-h66j-xm43-47pp

high2026-01-15

CVE-2021-47763-Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter

aimeos/aimeos-laravel · GHSA-hm9j-cgmm-2w36

high2026-01-15

CVE-2026-23519-RustCrypto Utilities cmov: `thumbv6m-none-eabi` compiler emits non-constant time assembly when using `cmovnz`

rustcrypto/utils · GHSA-2gqc-6j2q-83qp

medium2026-01-15

CVE-2026-23511-Zitadel has a user enumeration vulnerability in Login UIs

zitadel/zitadel · GHSA-pvm5-9frx-264r

medium2026-01-15

CVE-2026-23496-Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization

pimcore/pimcore · GHSA-4wg4-p27p-5q2r

medium2026-01-15

CVE-2026-23495-Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing

pimcore/pimcore · GHSA-hqrp-m84v-2m2f

medium2026-01-15

CVE-2026-23494-Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing

pimcore/pimcore · GHSA-m3r2-724c-pwgf

high2026-01-15

CVE-2026-23493-Pimcore ENV Variables and Cookie Informations are exposed in http_error_log

pimcore/pimcore · GHSA-q433-j342-rp9h