Security advisories

high2026-09-17

CVE-2026-77406-RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration

View chart →

rabbitmq/amqp091-go · GHSA-rm6m-hrcw-jw33

critical2026-09-17

CVE-2026-77405-RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser

View chart →

rabbitmq/amqp091-go · GHSA-33mj-cw25-m34h

high2026-09-17

CVE-2026-77404-RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

View chart →

rabbitmq/amqp091-go · GHSA-465g-fh3v-9jw4

high2026-09-17

CVE-2026-77403-RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation

View chart →

rabbitmq/amqp091-go · GHSA-xwwf-m8fg-p9q2

low2026-09-17

CVE-2026-86071-Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

View chart →

junrar/junrar · GHSA-89m4-43j5-vhhx

medium2026-09-17

CVE-2026-77401-Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

View chart →

zopefoundation/accesscontrol · GHSA-pq59-9fq7-m886

high2026-09-17

CVE-2026-76825-RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution

View chart →

zopefoundation/restrictedpython · GHSA-hp3v-5vw7-fx9w

high2026-09-17

CVE-2026-85715-ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

View chart →

mattiasw/exifreader · GHSA-pj96-35fp-cfcc

low2026-09-17

CVE-2026-61700-MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

View chart →

mariadb-corporation/mariadb-connector-j · GHSA-wxmm-q36w-r9xj

high2026-09-17

CVE-2026-69197-Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

View chart →

umbraco/umbraco-cms · GHSA-wr57-hqmp-fgvh

medium2026-09-17

CVE-2026-85078-sanic chunked trailer request smuggling allows hidden second request execution

View chart →

sanic-org/sanic · GHSA-wmj6-g64g-j7q5

high2026-09-17

CVE-2026-63506-Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

View chart →

tinacms/tinacms · GHSA-g74q-6g2f-874x

medium2026-09-17

CVE-2026-63225-Redocly CLI: Path traversal when using `split` command

View chart →

redocly/redocly-cli · GHSA-657c-g7qc-r9j2

high2026-09-17

CVE-2026-82410-Pocketbase: Unhandled panic in worker goroutines

View chart →

pocketbase/pocketbase · GHSA-84vh-m24q-wjjx

medium2026-09-17

CVE-2026-61449-Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer

View chart →

getgrav/grav · GHSA-8h9x-89f2-m7x3

medium2026-09-17

CVE-2026-62949-AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

View chart →

ronf/asyncssh · GHSA-rw4j-r22c-9gc3

high2026-09-17

CVE-2026-63126-Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

View chart →

square/wire · GHSA-9rm7-3qhh-h2mc

medium2026-09-17

CVE-2026-77360-oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

View chart →

middleapi/orpc · GHSA-j9v4-rhgr-4m5f

high2026-09-17

CVE-2026-75516-RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

View chart →

rabbitmq/rabbitmq-java-client · GHSA-jh4v-gfqj-7rhx

critical2026-09-17

CVE-2026-75513-Marten's LINQ provider has SQL injection via unescaped string literals

View chart →

jasperfx/marten · GHSA-rfx3-98h7-v3xp