Security advisories

medium2026-01-07

CVE-2026-22242-CoreShop Vulnerable to SQL Injection via Admin Reports

coreshop/coreshop · GHSA-ch7p-mpv4-4vg4

low2026-01-07

CVE-2026-22041-loggingredactor converts non-string types to string types in logs

armurox/loggingredactor · GHSA-rvjx-cfjh-5mc9

high2026-01-07

CVE-2026-22028-Preact has JSON VNode Injection issue

preactjs/preact · GHSA-36hm-qxxp-pg3m

medium2026-01-07

CVE-2026-21894-n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks

n8n-io/n8n · GHSA-jf52-3f2h-h9j5

medium2026-01-07

CVE-2026-21885-Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources

miniflux/v2 · GHSA-xwh2-742g-w3wp

critical2026-01-07

CVE-2026-21858-n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

n8n-io/n8n · GHSA-v4pr-fm98-w9pg

high2026-01-07

CVE-2026-21441-Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

urllib3/urllib3 · GHSA-38jv-5279-wg99

high2026-01-07

CVE-2025-69264-pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

pnpm/pnpm · GHSA-379q-355j-w6rj

high2026-01-07

CVE-2025-69263-pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies

pnpm/pnpm · GHSA-7vhp-vf5g-r2fw

high2026-01-07

CVE-2025-69262-pnpm vulnerable to Command Injection via environment variable substitution

pnpm/pnpm · GHSA-2phv-j68v-wwqx

medium2026-01-07

CVE-2025-69255-RustFS gRPC GetMetrics deserialization panic enables remote DoS

rustfs/rustfs · GHSA-gw2x-q739-qhcr

high2026-01-07

CVE-2025-67364-fast-filesystem-mcp has a Path Traversal vulnerability

efforthye/fast-filesystem-mcp · GHSA-j893-m93w-jwjw

critical2026-01-07

CVE-2025-61492-terminal-controller-mcp vulnerable to Command Injection

gongrzhe/terminal-controller-mcp · GHSA-h4rf-624j-gj33

critical2026-01-07

CVE-2025-12543-Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests

undertow-io/undertow · GHSA-j382-5jj3-vw4j

high2026-01-07

CVE-2025-68705-RustFS Path Traversal Vulnerability

rustfs/rustfs · GHSA-pq29-69jg-9mxc

medium2026-01-07

CVE-2025-66560-Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write

quarkusio/quarkus · GHSA-5rfx-cp42-p624

critical2026-01-07

CVE-2026-0650-OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware

openflagr/flagr · GHSA-rwp9-5g7q-73q3

high2026-01-07

CVE-2025-9611-Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools

microsoft/playwright-mcp · GHSA-6fg3-hvw7-2fwq

low2026-01-07

CVE-2024-14020-carbone Code Injection vulnerability

carboneio/carbone · GHSA-6rcw-ww3x-xqwm

medium2026-01-06

CVE-2026-22032-Directus has open redirect in SAML

directus/directus · GHSA-3573-4c68-g8cc