Security advisories

low2026-01-06

CVE-2026-21895-rsa crate has potential panic on a prime being equal to 1

rustcrypto/rsa · GHSA-9c48-w39g-hm26

medium2026-01-06

CVE-2026-21892-Parsl Monitoring Visualization Vulnerable to SQL Injection

parsl/parsl · GHSA-f2mf-q878-gh58

critical2026-01-06

Bypassing Kyverno Policies via Double Policy Exceptions

kyverno/kyverno · GHSA-gg4x-fgg2-h9w9

medium2026-01-06

CVE-2026-21883-Bokeh server applications have Incomplete Origin Validation in WebSockets

bokeh/bokeh · GHSA-793v-589g-574v

critical2026-01-06

CVE-2026-21877-n8n Vulnerable to RCE via Arbitrary File Write

n8n-io/n8n · GHSA-v364-rw7m-3263

medium2026-01-06

CVE-2026-21859-Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability

axllent/mailpit · GHSA-8v65-47jx-7mfr

medium2026-01-06

CVE-2026-21851-MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download

project-monai/monai · GHSA-9rg3-9pvr-6p27

medium2026-01-06

CVE-2025-69197-Pterodactyl TOTPs can be reused during validity window

pterodactyl/panel · GHSA-rgmp-4873-r683

high2026-01-06

CVE-2025-68954-Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

pterodactyl/panel · GHSA-8c39-xppg-479c

low2026-01-05

CVE-2025-69230-AIOHTTP Vulnerable to Cookie Parser Warning Storm

aio-libs/aiohttp · GHSA-fh55-r93g-j68g

medium2026-01-05

CVE-2025-69229-AIOHTTP vulnerable to DoS through chunked messages

aio-libs/aiohttp · GHSA-g84x-mcqj-x9qq

medium2026-01-05

CVE-2025-69228-AIOHTTP vulnerable to denial of service through large payloads

aio-libs/aiohttp · GHSA-6jhg-hg63-jvvf

medium2026-01-05

CVE-2025-69227-AIOHTTP vulnerable to DoS when bypassing asserts

aio-libs/aiohttp · GHSA-jj3x-wxrx-4x23

low2026-01-05

CVE-2025-69226-AIOHTTP vulnerable to brute-force leak of internal static file path components

aio-libs/aiohttp · GHSA-54jq-c3m8-4m76

low2026-01-05

CVE-2025-69225-AIOHTTP has unicode match groups in regexes for ASCII protocol elements

aio-libs/aiohttp · GHSA-mqqc-3gqh-h2x8

low2026-01-05

CVE-2025-69224-AIOHTTP's unicode processing of header values could cause parsing discrepancies

aio-libs/aiohttp · GHSA-69f9-5gxw-wvc2

high2026-01-05

CVE-2025-69223-AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

aio-libs/aiohttp · GHSA-6mq8-rvhq-8wgg

high2026-01-05

CVE-2025-66648-`vega-functions` vulnerable to Cross-site Scripting via `setdata` function

vega/vega · GHSA-m9rg-mr6g-75gm

high2026-01-05

CVE-2025-65110-Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope

vega/vega · GHSA-829q-m3qg-ph8r

high2026-01-05

CVE-2025-61916-Spinnaker vulnerable to SSRF due to improper restrictions on http from user input

spinnaker/spinnaker · GHSA-vrjc-q2fh-6x9h