Security advisories

high2026-01-09

CVE-2026-22612-Fickling vulnerable to detection bypass due to "builtins" blindness

trailofbits/fickling · GHSA-h4rm-mm56-xf63

high2026-01-09

CVE-2026-22698-SM2-PKE has 32-bit Biased Nonce Vulnerability

rustcrypto/elliptic-curves · GHSA-w3g8-fp6j-wvqw

medium2026-01-09

CVE-2025-60538-Shiori is vulnerable to authentication bypass via a brute force attack

go-shiori/shiori · GHSA-mw8h-g64c-rxv4

high2026-01-09

CVE-2026-22609-Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

trailofbits/fickling · GHSA-q5qq-mvfm-j35x

high2026-01-09

CVE-2026-22608-Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

trailofbits/fickling · GHSA-5hvc-6wx8-mvv4

high2026-01-09

CVE-2026-22607-Fickling Blocklist Bypass: cProfile.run()

trailofbits/fickling · GHSA-p523-jq9w-64x9

high2026-01-09

CVE-2026-22606-Fickling has a bypass via runpy.run_path() and runpy.run_module()

trailofbits/fickling · GHSA-wfq2-52f7-7qvj

medium2026-01-09

CVE-2025-61676-October CMS Vulnerable to Stored XSS via Branding Styles

octobercms/october · GHSA-wvpq-h33f-8rp6

low2026-01-09

mnl has segmentation fault and invalid memory read in `mnl::cb_run`

mullvad/mnl-rs · GHSA-585q-cm62-757j

low2026-01-09

CVE-2026-22691-pypdf has possible long runtimes for malformed startxref

py-pdf/pypdf · GHSA-4f6g-68pf-7vhv

low2026-01-09

CVE-2026-22690-pypdf has possible long runtimes for missing /Root object with large /Size values

py-pdf/pypdf · GHSA-4xc4-762w-m6cg

high2026-01-09

jose-swift has JWT Signature Verification Bypass via None Algorithm

beatt83/jose-swift · GHSA-88q6-jcjg-hvmw

critical2026-01-09

CVE-2026-22688-WeKnora has Command Injection in MCP stdio test

tencent/weknora · GHSA-78h3-63c4-5fqc

medium2026-01-09

CVE-2026-22687-WeKnora vulnerable to SQL Injection

tencent/weknora · GHSA-pcwc-3fw3-8cqv

low2026-01-09

CVE-2026-22611-AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value

aws/aws-sdk-net · GHSA-9cvc-h2w8-phrp

high2026-01-09

CVE-2026-22610-Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

angular/angular · GHSA-jrmj-c5cx-3cw6

critical2026-01-09

CVE-2025-65091-XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService

xwiki-contrib/macro-fullcalendar · GHSA-2g22-wg49-fgv5

medium2026-01-09

CVE-2025-65090-XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

xwiki-contrib/macro-fullcalendar · GHSA-637h-ch24-xp9m

medium2026-01-09

CVE-2025-61674-October CMS Vulnerable to Stored XSS via Editor and Branding Styles

octobercms/october · GHSA-gxxc-m74c-f48x

critical2026-01-09

CVE-2025-70974-FASTJSON Includes Functionality from Untrusted Control Sphere

alibaba/fastjson · GHSA-jm7w-5684-pvh8