Security advisories

medium2026-01-08

CVE-2025-68470-React Router has unexpected external redirect via untrusted paths

remix-run/react-router · GHSA-9jcx-v3wj-wh4m

critical2026-01-08

CVE-2025-61686-React Router has Path Traversal in File Session Storage

remix-run/react-router · GHSA-9583-h5hc-x8cw

high2026-01-08

CVE-2025-59057-React Router has XSS Vulnerability

remix-run/react-router · GHSA-3cgp-3xvw-98x8

medium2026-01-08

CVE-2026-22043-RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

rustfs/rustfs · GHSA-xgr5-qc6w-vcg9

medium2026-01-08

CVE-2026-22042-RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

rustfs/rustfs · GHSA-vcwh-pff9-64cc

medium2026-01-08

CVE-2026-21896-Kirby is missing permission checks in the content changes API

getkirby/kirby · GHSA-4j78-4xrm-cr2f

medium2026-01-08

CVE-2026-21874-NiceGUI has Redis connection leak via tab storage causes service degradation

zauberzeug/nicegui · GHSA-mp55-g7pj-rvm2

high2026-01-08

CVE-2026-21873-NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS

zauberzeug/nicegui · GHSA-mhpg-c27v-6mxr

medium2026-01-08

CVE-2025-68151-CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages

coredns/coredns · GHSA-527x-5wrf-22m2

medium2026-01-08

CVE-2026-21872-NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

zauberzeug/nicegui · GHSA-m7j5-rq9j-6jj9

medium2026-01-08

CVE-2026-21871-NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

zauberzeug/nicegui · GHSA-7grm-h62g-5m97

medium2026-01-08

CVE-2026-21860- Werkzeug safe_join() allows Windows special device names with compound extensions

pallets/werkzeug · GHSA-87hc-h4r5-73f7

high2026-01-08

CVE-2026-53872-picklescan has Arbitrary file read using `io.FileIO`

mmaitre314/picklescan · GHSA-9726-w42j-3qjr

medium2026-01-08

CVE-2026-0707-Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

keycloak/keycloak · GHSA-gv94-wp4h-vv8p

critical2026-01-08

CVE-2025-15346-wolfSSL Python module vulnerable to Improper Authentication

wolfssl/wolfssl-py · GHSA-vj87-jj27-4h9c

medium2026-01-08

CVE-2023-7333-records-mover Injection vulnerability

bluelabsio/records-mover · GHSA-p3jp-7gj7-h6pr

medium2026-01-07

CVE-2026-22187-Bio-Formats performs unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing

ome/bioformats · GHSA-qjm3-cvp9-3jj3

medium2026-01-07

CVE-2026-22186-Bio-Formats has an XML External Entity (XXE) vulnerability

ome/bioformats · GHSA-fcqj-76g3-q7qm

low2026-01-07

`IterMut` violates Stacked Borrows by invalidating internal pointer

jeromefroe/lru-rs · GHSA-rhfx-m35p-ff5j

high2026-01-07

CVE-2026-22244-OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE

open-metadata/openmetadata · GHSA-5f29-2333-h9c7