Security advisories

high2026-09-21

CVE-2026-61628- nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

View chart →

lucasdillmann/nginx-ignition · GHSA-pxcx-fv34-x9p5

high2026-09-21

CVE-2026-61629-nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

View chart →

lucasdillmann/nginx-ignition · GHSA-jr34-h97m-9hpx

medium2026-09-21

CVE-2026-61630-nginx ignition has TOTP Reuse During Validity Window

View chart →

lucasdillmann/nginx-ignition · GHSA-hf33-q6cf-c66f

medium2026-09-21

k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers

View chart →

falcosecurity/plugins · GHSA-jhjp-4c2q-xmx4

high2026-09-21

CVE-2026-61687-Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

View chart →

hatchet-dev/hatchet · GHSA-phg3-3g28-wq9v

high2026-09-18

CVE-2026-93748-http-cache-semantics max-stale handling can disclose cross-user cached responses

View chart →

kornelski/http-cache-semantics · GHSA-ch52-4w7c-c8xp

high2026-09-18

CVE-2026-93749-source-map-js allows event-loop denial of service through indexed source-map section offsets

View chart →

7rulnik/source-map-js · GHSA-68fv-2mgg-jv7q

high2026-09-18

Obot: Server-Side Request Forgery via remote MCP server URL

View chart →

obot-platform/obot · GHSA-jgh3-fggc-mcpm

medium2026-09-18

Obot: MCP Registry API readable without authentication

View chart →

obot-platform/obot · GHSA-pr6h-vr44-xq8j

high2026-09-18

Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion

View chart →

obot-platform/obot · GHSA-xwmw-prc4-v3cr

medium2026-09-18

CVE-2026-71537-Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)

View chart →

paymenter/paymenter · GHSA-5gmm-hjfj-8ff7

high2026-09-18

CVE-2026-85058-io.moquette:moquette-broker has a Missing Authorization issue

View chart →

moquette-io/moquette · GHSA-9jjc-fw8x-fmwx

critical2026-09-18

CVE-2026-59163-Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

View chart →

axdsan/mnemosyne · GHSA-xcw4-53cc-hv32

high2026-09-18

CVE-2026-63445-Perses's unvalidated project parameter enables filesystem path traversal

View chart →

perses/perses · GHSA-vr5f-w35q-98jp

high2026-09-18

CVE-2026-63199-Perses's missing authorization in datasource proxy allows cross-scope secret disclosure

View chart →

perses/perses · GHSA-4227-9989-jrhx

high2026-09-18

CVE-2026-63458-Perses's project query parameter authorization bypass exposes cross-project resources

View chart →

perses/perses · GHSA-cjgj-2fwf-4c2w

high2026-09-18

CVE-2026-91127-File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

View chart →

flyfish-dev/file-viewer · GHSA-3753-m2x2-q623

high2026-09-18

CVE-2026-77301-adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

View chart →

cthackers/adm-zip · GHSA-7q85-xj36-vmfc

medium2026-09-18

CVE-2026-77339-Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

View chart →

f1bonacc1/process-compose · GHSA-5gm3-9crp-6g3v

high2026-09-18

CVE-2026-81505-Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials

View chart →

frain-dev/convoy · GHSA-p5vg-v7mj-f6q4