Security advisories

medium2026-01-05

CVE-2025-67427-evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API

evershopcommerce/evershop · GHSA-vp8w-wj4m-3r7j

high2026-01-05

CVE-2025-67419-evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API

evershopcommerce/evershop · GHSA-m2q5-xhqg-92r2

high2026-01-05

CVE-2026-0621-Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

modelcontextprotocol/typescript-sdk · GHSA-8r9q-7v3j-jr4g

critical2026-01-05

CVE-2025-62877-Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer

harvester/harvester · GHSA-6g8q-hp2j-gvwv

high2026-01-05

CVE-2026-21857-Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

redaxo/redaxo · GHSA-824x-88xg-cwrv

medium2026-01-05

CVE-2026-73645-ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.

openzeppelin/openzeppelin-confidential-contracts · GHSA-hqf9-8xv5-x8xw

medium2026-01-05

CVE-2026-0810-gix-date can create non-utf8 string with `TimeBuf::as_str`

gitoxidelabs/gitoxide · GHSA-6mw6-mj76-grwc

medium2026-01-05

Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass

bishopfox/sliver · GHSA-hjr9-wj7v-7hv8

low2026-01-05

CVE-2026-21439-badkeys vulnerable to ASCII control character injection on console via malformed input

badkeys/badkeys · GHSA-wjpc-4f29-83h3

high2026-01-05

CVE-2025-68455-Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

craftcms/cms · GHSA-255j-qw47-wjh5

high2026-01-05

CVE-2025-68456-Unauthenticated Craft CMS users can trigger a database backup

craftcms/cms · GHSA-v64r-7wg9-23pr

medium2026-01-05

CVE-2025-68454-Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

craftcms/cms · GHSA-742x-x762-7383

medium2026-01-05

CVE-2025-68437-Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation

craftcms/cms · GHSA-x27p-wfqw-hfcc

medium2026-01-05

CVE-2025-68436-Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

craftcms/cms · GHSA-53vf-c43h-j2x9

critical2026-01-05

CVE-2025-68428-jsPDF has Local File Inclusion/Path Traversal vulnerability

parallax/jspdf · GHSA-f8cm-6447-x5h2

medium2026-01-05

CVE-2025-68280-Apache SIS has Improper Restriction of XML External Entity Reference vulnerability

apache/sis · GHSA-jqmr-2pg9-vfx7

high2026-01-05

flagd: Multiple Go Runtime CVEs Impact Security and Availability

open-feature/flagd · GHSA-4c5f-9mj4-m247

high2026-01-05

CVE-2026-21452-MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation

msgpack/msgpack-java · GHSA-cw39-r4h6-8j3x

high2026-01-05

CVE-2025-66518-Apache Kyuubi Server vulnerable to Path Traversal

apache/kyuubi · GHSA-f8r6-6222-9pvc

medium2026-01-05

CVE-2025-15022-Vaadin vulnerable to Cross-site Scripting

vaadin/flow-components · GHSA-7wwv-79xw-rvvg