Security advisories

medium2026-09-22

CVE-2026-63627-mppx: Gas Draining with padding

View chart →

wevm/mppx · GHSA-727h-3vm5-qwq6

medium2026-09-22

CVE-2026-63342-Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

View chart →

hatchet-dev/hatchet · GHSA-g26x-m427-f48f

medium2026-09-22

CVE-2026-61681-Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

View chart →

hatchet-dev/hatchet · GHSA-fjwv-jf2v-j499

low2026-09-22

CVE-2026-62364-wlc may disclose API tokens to project-configured URLs

View chart →

weblateorg/wlc · GHSA-3mqq-hv9c-85hc

high2026-09-22

CVE-2026-58268-SIPGO: DoS via unvalidated Content-Length in the stream parser

View chart →

emiago/sipgo · GHSA-pg59-5vwg-4jxq

high2026-09-22

CVE-2026-63116-deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

View chart →

deepstreamio/deepstream.io · GHSA-89vx-jh4q-vg3w

high2026-09-22

CVE-2026-62985-request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

View chart →

azu/request-filtering-agent · GHSA-r3r9-wp5j-pq5g

medium2026-09-22

CVE-2026-62866-Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

View chart →

tomwright/dasel · GHSA-65gg-g7rw-6cpc

medium2026-09-22

CVE-2026-59168-Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

View chart →

tomwright/dasel · GHSA-cqxr-jxr2-85pq

medium2026-09-22

CVE-2026-62282-OpenCVE: Server-Side Request Forgery (SSRF) in notifications

View chart →

opencve/opencve · GHSA-ch3g-4xvr-674q

high2026-09-22

CVE-2026-59991-psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

View chart →

psd-tools/psd-tools · GHSA-8q6g-vjhf-jp8m

medium2026-09-22

CVE-2026-61670-microsandbox: Secret values exposed in world-readable process arguments

View chart →

superradcompany/microsandbox · GHSA-m8f5-rh7h-vgg3

medium2026-09-22

CVE-2026-56682-9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

View chart →

decolua/9router · GHSA-32gc-64m7-hj7v

high2026-09-22

CVE-2026-56681-9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

View chart →

decolua/9router · GHSA-5mj8-gf6m-fhw8

medium2026-09-22

CVE-2026-61612-@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

View chart →

ondata/ckan-mcp-server · GHSA-798p-78g2-v556

medium2026-09-22

CVE-2026-58272-Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

View chart →

sync-in/server · GHSA-29hq-23m2-2j47

medium2026-09-22

CVE-2026-58270-Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

View chart →

sync-in/server · GHSA-jx63-h26r-8cph

high2026-09-22

CVE-2026-58269-Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

View chart →

sync-in/server · GHSA-92cr-jxw4-5wjg

medium2026-09-22

CVE-2026-58271-@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

View chart →

sync-in/server · GHSA-274f-6w77-8qm9

high2026-09-22

CVE-2026-61647-@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

View chart →

roomi-fields/notebooklm-mcp · GHSA-jjhp-8crj-mppq