Security advisories

medium2026-09-17

CVE-2026-72832-Grav: Stored XSS via quoted-attribute bypass in detectXss

View chart →

getgrav/grav · GHSA-269c-h76q-8cxw

medium2026-09-17

CVE-2026-85717-AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target

View chart →

asynchttpclient/async-http-client · GHSA-f8m2-889x-vw4x

medium2026-09-17

CVE-2026-85720-AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request

View chart →

asynchttpclient/async-http-client · GHSA-xr57-gcx8-52hf

high2026-09-17

CVE-2026-85721-AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

View chart →

asynchttpclient/async-http-client · GHSA-7grg-jcf7-rpmx

low2026-09-17

CVE-2026-85716-AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses

View chart →

asynchttpclient/async-http-client · GHSA-fj9w-c36g-h5x8

high2026-09-17

CVE-2026-85756-SSH.NET: ScpClient allows server-side RCE via default SCP path handling

View chart →

sshnet/ssh.net · GHSA-mggc-4xg6-vcxf

medium2026-09-17

CVE-2026-73245-Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

View chart →

kestra-io/kestra · GHSA-hpj9-grjp-7vc7

medium2026-09-17

CVE-2026-69147-vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

View chart →

vllm-project/vllm · GHSA-8pw2-6jv3-mj5j

high2026-09-17

CVE-2026-69089-Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images

View chart →

getgrav/grav · GHSA-w3f4-8pj2-599w

high2026-09-17

CVE-2026-69088-Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

View chart →

getgrav/grav · GHSA-7pgq-cr25-xvc8

medium2026-09-17

CVE-2026-85732-oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

View chart →

oras-project/oras-go · GHSA-h7vf-4x9w-h99v

high2026-09-17

CVE-2026-85731-oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

View chart →

oras-project/oras-go · GHSA-m37j-52j7-pjw7

high2026-09-17

CVE-2026-73247-Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

View chart →

kestra-io/kestra · GHSA-r56g-q4p6-m3p6

high2026-09-17

CVE-2026-65608-Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

View chart →

getgrav/grav · GHSA-c4wf-2xxc-68qm

high2026-09-17

CVE-2026-86043-Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)

View chart →

zalando/skipper · GHSA-5gpm-rgj3-9q76

high2026-09-17

CVE-2026-77412-RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client

View chart →

rabbitmq/amqp091-go · GHSA-4v58-74mf-rjx3

critical2026-09-17

CVE-2026-77411-RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr

View chart →

rabbitmq/amqp091-go · GHSA-c5pq-fr2g-9jpf

high2026-09-17

CVE-2026-77410-RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation

View chart →

rabbitmq/amqp091-go · GHSA-r9c8-gcjp-xfwh

critical2026-09-17

CVE-2026-77408-RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

View chart →

rabbitmq/amqp091-go · GHSA-j497-x9hr-x34x

high2026-09-17

CVE-2026-77407-RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

View chart →

rabbitmq/amqp091-go · GHSA-27gv-rfvv-22mv