Security advisories

medium2026-01-02

CVE-2026-21483-listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover

knadh/listmonk · GHSA-jmr4-p576-v565

high2026-01-02

CVE-2026-21449-Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users

bagisto/bagisto · GHSA-mqhg-v22x-pqj8

high2026-01-02

CVE-2026-21447-Bagisto has IDOR in Customer Order Reorder Functionality

bagisto/bagisto · GHSA-x5rw-qvvp-5cgm

high2026-01-02

CVE-2026-21448-Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

bagisto/bagisto · GHSA-5j4h-4f72-qpm6

high2026-01-02

CVE-2026-21450-Bagisto SSTI vulnerability in type parameter can lead to RCE

bagisto/bagisto · GHSA-9hvg-qw5q-wqwp

medium2026-01-02

CVE-2026-21451-Bagisto has HTML Filter Bypass that Enables Stored XSS

bagisto/bagisto · GHSA-2mwc-h2mg-v6p8

high2026-01-02

CVE-2026-21446-Bagisto Missing Authentication on Installer API Endpoints

bagisto/bagisto · GHSA-6h7w-v2xr-mqvw

high2026-01-02

CVE-2026-21445-Langflow Missing Authentication on Critical API Endpoints

langflow-ai/langflow · GHSA-c5cp-vx83-jhqx

critical2026-01-02

CVE-2026-21440-AdonisJS Path Traversal in Multipart File Handling

adonisjs/core · GHSA-gvq6-hvvp-h34h

critical2026-01-02

CVE-2025-68620-Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

signalk/signalk-server · GHSA-fq56-hvg6-wvm5

medium2026-01-02

CVE-2025-69203-Signal K Server Vulnerable to Access Request Spoofing

signalk/signalk-server · GHSA-vfrf-vcj7-wvr8

high2026-01-02

CVE-2025-68619-Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package

signalk/signalk-server · GHSA-93jc-vqqc-vvvh

medium2026-01-02

CVE-2025-68273-Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

signalk/signalk-server · GHSA-fpf5-w967-rr2m

high2026-01-02

CVE-2025-68272-Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding

signalk/signalk-server · GHSA-7rqc-ff8m-7j23

critical2026-01-02

CVE-2025-66398-Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

signalk/signalk-server · GHSA-w3x5-7c4c-66p9

medium2026-01-01

CVE-2025-47411-Apache StreamPipes has Improper Privilege Management issue

apache/streampipes · GHSA-5r2g-vphf-m5xc

high2026-01-01

CVE-2025-11157-Feast vulnerable to Deserialization of Untrusted Data

feast-dev/feast · GHSA-34wm-4hw7-qfjv

medium2026-01-01

CVE-2025-69413-Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists

go-gitea/gitea · GHSA-pc73-rj2c-wvf9

medium2025-12-31

Trix has a stored XSS vulnerability through its attachment attribute

basecamp/trix · GHSA-g9jg-w8vm-g96v

high2025-12-31

CVE-2025-69256-serverless MCP Server vulnerable to Command Injection in list-projects tool

serverless/serverless · GHSA-rwc2-f344-q6w6