Security advisories

high2026-01-13

CVE-2026-22862-go-ethereum is vulnerable to DoS via malicious p2p message affecting a vulnerable node

ethereum/go-ethereum · GHSA-mr7q-c9w9-wh4h

high2026-01-13

CVE-2026-22871-GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE

datadog/guarddog · GHSA-xg9w-vg3g-6m68

high2026-01-13

CVE-2026-22870-GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS

datadog/guarddog · GHSA-ffj4-jq7m-9g6v

medium2026-01-13

CVE-2026-0859-TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

typo3/typo3 · GHSA-7vp9-x248-9vr9

medium2026-01-13

CVE-2026-22820-Outray cli is vulnerable to race conditions in tunnels creation

akinloluwami/outray · GHSA-3pqc-836w-jgr7

medium2026-01-13

CVE-2026-22819-Outray has a Race Condition in the cli's webapp

akinloluwami/outray · GHSA-45hj-9x76-wp9g

high2026-01-13

CVE-2026-22818-Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)

honojs/hono · GHSA-3vhc-576x-3qv4

high2026-01-13

CVE-2026-22817-Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass

honojs/hono · GHSA-f67f-6cw9-8mq4

high2026-01-13

CVE-2026-23949-jaraco.context Has a Path Traversal Vulnerability

jaraco/jaraco.context · GHSA-58pv-8j8x-9vj2

medium2026-01-13

CVE-2026-0528-Metricbeat affected by multiple denial of service vulnerabilities

elastic/beats · GHSA-w2gr-585j-r428

low2026-01-13

CVE-2025-15056-Quill is vulnerable to XSS via HTML export feature

slab/quill · GHSA-v3m3-f69x-jf25

high2026-01-13

CVE-2026-21226-Azure Core is vulnerable to deserialization of untrusted data

azure/azure-sdk-for-python · GHSA-jm66-cg57-jjv5

high2026-01-13

CVE-2025-59022-TYPO3 CMS Allows Broken Access Control in Recycler Module

typo3/typo3 · GHSA-p52w-7rhw-9m67

medium2026-01-13

CVE-2025-59021-TYPO3 CMS Allows Broken Access Control in Redirects Module

typo3/typo3 · GHSA-6c46-p6j5-3f49

medium2026-01-13

CVE-2025-59020-TYPO3 CMS Allows Broken Access Control in Edit Document Controller

typo3/typo3 · GHSA-5j7q-wmh7-cqhg

high2026-01-13

CVE-2026-22814-Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State

adonisjs/lucid · GHSA-g5gc-h5hp-555f

critical2026-01-13

CVE-2026-22813-Malicious website can execute commands on the local system through XSS in the OpenCode web UI

anomalyco/opencode · GHSA-c83v-7274-4vgp

medium2026-01-13

CVE-2026-22809-tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability

amauric/tarteaucitron.js · GHSA-q5f6-qxm2-mcqm

high2026-01-13

CVE-2026-22812-OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

anomalyco/opencode · GHSA-vxw4-wv6m-9hhh

medium2026-01-13

CVE-2026-22798-hermes's raw options logging may disclose secrets passed in via subcommand options argument

softwarepub/hermes · GHSA-jm5j-jfrm-hm23