Security advisories

high2026-01-15

CVE-2026-22803-@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)

sveltejs/kit · GHSA-j2f3-wq62-6q46

high2026-01-15

CVE-2026-22774-Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse

sveltejs/devalue · GHSA-vw5p-8cq8-m7mv

high2026-01-15

CVE-2025-67647-SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering

sveltejs/kit · GHSA-j62c-4x62-9r35

high2026-01-15

CVE-2025-66292-DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface

donknap/dpanel · GHSA-vh2x-fw87-4fxq

low2026-01-15

CVE-2026-0976-Keycloak has an improper input validation vulnerability

keycloak/keycloak · GHSA-v897-pv23-r8cw

medium2026-01-14

Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling

algolia/algoliasearch-magento-2 · GHSA-595p-g7xc-c333

low2026-01-14

CVE-2026-24001-jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

kpdecker/jsdiff · GHSA-73rr-hh4g-fpgx

medium2026-01-14

CVE-2025-69725-chi has an open redirect vulnerability in the RedirectSlashes middleware

go-chi/chi · GHSA-mqqf-5wvp-8fh8

high2026-01-14

CVE-2026-23492-Pimcore Has an Incomplete Patch for CVE-2023-30848

pimcore/pimcore · GHSA-qvr7-7g55-69xj

medium2026-01-14

CVE-2026-22036-Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

nodejs/undici · GHSA-g9mf-h72j-4rw9

medium2026-01-14

CVE-2025-63644-pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability

ph7software/ph7-social-dating-cms · GHSA-657c-wxg6-jmqv

high2026-01-14

CVE-2026-23498-Shopware Has Improper Control of Generation of Code in Twig rendered views

shopware/shopware · GHSA-7cw6-7h3h-v8pf

high2026-01-14

CVE-2026-22787-html2pdf.js contains a cross-site scripting vulnerability

ekoopmans/html2pdf.js · GHSA-w8x4-x68c-m6fc

medium2026-01-14

CVE-2026-22779-BlackSheep's ClientSession is vulnerable to CRLF injection

neoteroi/blacksheep · GHSA-6pw3-h7xf-x4gp

critical2026-01-14

CVE-2026-22686-enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain

agentfront/enclave · GHSA-7qm7-455j-5p63

low2026-01-14

CVE-2026-21889-Weblate leaks information via screenshots

weblateorg/weblate · GHSA-3g2f-4rjg-9385

medium2026-01-14

CVE-2025-66169-Apache Camel camel-neo4j component is vulnerable to cypher injection

apache/camel · GHSA-4jrw-64vr-7g8m

low2026-01-14

CVE-2025-68492-Chainlit contains an authorization bypass vulnerability

chainlit/chainlit · GHSA-v492-6xx2-p57g

medium2026-01-14

CVE-2022-50807-Concrete5 CMS contains an XPath injection vulnerability

concretecms/concretecms · GHSA-r7vr-wg3f-8hr9

high2026-01-13

CVE-2026-22868-go-ethereum is vulnerable to high CPU usage leading to DoS via malicious p2p message

ethereum/go-ethereum · GHSA-mq3p-rrmp-79jg