Security advisories

medium2026-01-13

Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file

renovatebot/renovate · GHSA-3f44-xw83-3pmg

medium2026-01-13

Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file

renovatebot/renovate · GHSA-xjr7-3c3g-m763

medium2026-01-13

Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies

renovatebot/renovate · GHSA-36j9-mx87-2cff

medium2026-01-13

Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration

renovatebot/renovate · GHSA-fr4j-65pv-gjjj

medium2026-01-13

Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository

renovatebot/renovate · GHSA-xv56-3wq5-9997

medium2026-01-13

Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`

renovatebot/renovate · GHSA-pfq2-hh62-7m96

critical2026-01-13

CVE-2025-68924-UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation

umbraco/umbraco.forms.issues · GHSA-vrgw-pc9c-qrrc

high2026-01-13

CVE-2026-22786-Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal

flipped-aurora/gin-vue-admin · GHSA-3558-j79f-vvm6

critical2026-01-13

CVE-2026-22785-orval MCP client is vulnerable to a code injection attack.

orval-labs/orval · GHSA-mwr6-3gp8-9jmj

high2026-01-13

CVE-2026-22777-ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler

comfy-org/comfyui-manager · GHSA-562r-8445-54r2

critical2026-01-13

CVE-2025-68271-openc3-api Vulnerable to Unauthenticated Remote Code Execution

openc3/cosmos · GHSA-w757-4qv9-mghp

medium2026-01-13

CVE-2026-22772-Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass

sigstore/fulcio · GHSA-59jp-pj84-45mr

high2026-01-13

CVE-2026-22771-Envoy Extension Policy lua scripts injection causes arbitrary command execution

envoyproxy/gateway · GHSA-xrwg-mqj6-6m22

medium2026-01-13

CVE-2026-22702-virtualenv Has TOCTOU Vulnerabilities in Directory Creation

pypa/virtualenv · GHSA-597g-3phw-6986

medium2026-01-13

CVE-2026-22701-filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock

tox-dev/filelock · GHSA-qmgc-5h2g-mvrw

medium2026-01-13

CVE-2026-22773-vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions

vllm-project/vllm · GHSA-grg2-63fw-f2qr

medium2026-01-13

CVE-2026-22689-Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails

axllent/mailpit · GHSA-524m-q5m7-79mm

medium2026-01-13

CVE-2026-22705-RustCrypto: Signatures has timing side-channel in ML-DSA decomposition

rustcrypto/signatures · GHSA-hcp2-x6j4-29j7

high2026-01-13

CVE-2026-22704-HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

haxtheweb/issues · GHSA-3fm2-xfq7-7778

high2026-01-13

CVE-2026-22700-RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE

rustcrypto/elliptic-curves · GHSA-j9xq-69pf-pcm8