Security advisories

critical2026-09-22

CVE-2026-91130-Home Assistant: XSS in Statistics Graph Card

View chart →

home-assistant/core · GHSA-wx4m-69m9-gx3m

medium2026-09-22

CVE-2026-91129-Home Assistant: mDNS Server-Side Request Forgery

View chart →

home-assistant/core · GHSA-4ghv-53cq-7wp3

medium2026-09-22

CVE-2026-88010-Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

View chart →

traefik/traefik · GHSA-8fcf-v89g-xpg6

medium2026-09-22

CVE-2026-88978-Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

View chart →

hatchet-dev/hatchet · GHSA-992g-9cr3-vm5x

low2026-09-22

CVE-2026-84298-Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

View chart →

hatchet-dev/hatchet · GHSA-9q4h-f4x5-ffq8

medium2026-09-22

CVE-2026-79913-Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

View chart →

cloudreve/cloudreve · GHSA-jvh5-97xg-v99f

medium2026-09-22

CVE-2026-79767-Gardener: Authorization Bypass via Group Subject Injection

View chart →

gardener/gardener · GHSA-gfjv-gqf2-c888

low2026-09-22

CVE-2026-77637-Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope

View chart →

cloudreve/cloudreve · GHSA-w89x-c962-c44g

high2026-09-22

CVE-2026-77633-Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

View chart →

cloudreve/cloudreve · GHSA-xj3h-wwxq-gfcj

high2026-09-22

CVE-2026-94462-Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

View chart →

spree/spree · GHSA-4825-p4xm-pcf2

medium2026-09-22

CVE-2026-86062-lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content

View chart →

hkuds/lightrag · GHSA-xpjq-3w4w-w5wr

high2026-09-22

CVE-2026-85740-lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

View chart →

hkuds/lightrag · GHSA-vv3m-f8x4-7377

critical2026-09-22

CVE-2026-85734-lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

View chart →

hkuds/lightrag · GHSA-frch-4w6v-q5xx

medium2026-09-22

CVE-2026-85725-lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function

View chart →

hkuds/lightrag · GHSA-c759-cx9p-mrwq

medium2026-09-22

CVE-2026-85709-lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

View chart →

hkuds/lightrag · GHSA-hrmj-7rvj-4hg8

medium2026-09-22

CVE-2026-83805-Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

View chart →

nautobot/nautobot · GHSA-q4c5-2j6f-r476

medium2026-09-22

CVE-2026-83801-Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

View chart →

nautobot/nautobot · GHSA-56v6-2fhr-wxgq

medium2026-09-22

CVE-2026-77528-Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

View chart →

crossbario/autobahn-python · GHSA-hxp9-w8x3-p566

medium2026-09-22

CVE-2026-76805-Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

View chart →

projectdiscovery/nuclei · GHSA-jpvm-9frm-hjcq

medium2026-09-22

CVE-2026-76804-Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

View chart →

projectdiscovery/nuclei · GHSA-qgw5-7j4f-fg97