Security advisories

medium2026-01-08

CVE-2025-68158-Authlib has 1-click Account Takeover vulnerability

authlib/authlib · GHSA-fg6f-75jq-6523

low2026-01-08

AWS SDK for Swift adopted defense in depth enhancement for region parameter value

awslabs/aws-sdk-swift · GHSA-pc9j-5v36-2mww

low2026-01-08

JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3

aws/aws-sdk-js · GHSA-j965-2qgj-vjmq

low2026-01-08

AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value

aws/aws-sdk-js-v3 · GHSA-6475-r3vj-m8vf

high2026-01-08

CVE-2026-56340-vLLM introduced enhanced protection for CVE-2025-62164

vllm-project/vllm · GHSA-mcmc-2m55-j8jj

low2026-01-08

AWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value

awslabs/aws-sdk-rust · GHSA-g59m-gf8j-gjf5

medium2026-01-08

CVE-2026-22596-Ghost has SQL Injection in Members Activity Feed

tryghost/ghost · GHSA-gjrp-xgmh-x9qq

medium2026-01-08

CVE-2026-22597-Ghost has SSRF via External Media Inliner

tryghost/ghost · GHSA-vmc4-9828-r48r

high2026-01-08

CVE-2026-22595-Ghost has Staff Token permission bypass

tryghost/ghost · GHSA-9xg7-mwmp-xmjx

low2026-01-08

CVE-2025-14505-Elliptic Uses a Cryptographic Primitive with a Risky Implementation

indutny/elliptic · GHSA-848j-6mx2-7j84

high2026-01-08

CVE-2026-22594-Ghost has Staff 2FA bypass

tryghost/ghost · GHSA-5fp7-g646-ccf4

high2026-01-08

CVE-2026-22589-Spree API has Unauthenticated IDOR - Guest Address

spree/spree · GHSA-3ghg-3787-w2xr

medium2026-01-08

CVE-2026-22588-Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

spree/spree · GHSA-g268-72p7-9j6j

high2026-01-08

CVE-2026-22256-Salvo is vulnerable to reflected XSS in the list_html function

salvo-rs/salvo · GHSA-rjf8-2wcw-f6mp

high2026-01-08

CVE-2026-22257-Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names

salvo-rs/salvo · GHSA-54m3-5fxr-2f3j

high2026-01-08

Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles

shakacode/shakapacker · GHSA-96qw-h329-v5rg

medium2026-01-08

CVE-2026-22253-Soft Serve is missing an authorization check in LFS lock deletion

charmbracelet/soft-serve · GHSA-6jm8-x3g6-r33j

medium2026-01-08

CVE-2026-22030-React Router has CSRF issue in Action/Server Action Request Processing

remix-run/react-router · GHSA-h5cw-625j-3rxh

high2026-01-08

CVE-2026-22029-React Router vulnerable to XSS via Open Redirects

remix-run/react-router · GHSA-2w69-qvjg-hvjx

high2026-01-08

CVE-2026-21884-React Router SSR XSS in ScrollRestoration

remix-run/react-router · GHSA-8v8x-cx79-35w7