Security advisories

medium2026-09-17

CVE-2026-59823-LiteLLM Proxy has server-side request forgery via the `user_config` request parameter

View chart →

berriai/litellm · GHSA-hx8v-g79f-8w5f

high2026-09-17

CVE-2026-71538-@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

View chart →

cyclonedx/cyclonedx-node-npm · GHSA-q69g-4hcv-6jg4

critical2026-09-17

CVE-2026-63472-Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

View chart →

vendurehq/vendure · GHSA-6j36-r6pr-59x4

medium2026-09-17

CVE-2026-63461-Vendure: Shop API list queries can return non-public entities when filterOperator is OR

View chart →

vendurehq/vendure · GHSA-xf65-r35x-wmmv

high2026-09-17

CVE-2026-63460-Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

View chart →

vendurehq/vendure · GHSA-jgm3-qmp2-c4p7

high2026-09-17

CVE-2026-63459-Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

View chart →

vendurehq/vendure · GHSA-xhq9-whgq-49j5

medium2026-09-17

CVE-2026-61793-Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

View chart →

nuxt-modules/og-image · GHSA-q8hw-4fvp-9rwv

medium2026-09-17

CVE-2026-64684-RMCP: Custom HTTP headers leak to cross-origin redirect targets

View chart →

modelcontextprotocol/rust-sdk · GHSA-9g45-5xwm-f3wc

medium2026-09-16

CVE-2026-61709-OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

View chart →

openfga/openfga · GHSA-g3pg-frfm-pr2m

medium2026-09-16

CVE-2026-58657-Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

View chart →

getgrav/grav · GHSA-ffmg-hfvg-jhg9

high2026-09-16

CVE-2026-63671-@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

View chart →

nuxt-content/mdc · GHSA-mxm6-v9r6-r94c

high2026-09-16

CVE-2026-63128-RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

View chart →

modelcontextprotocol/rust-sdk · GHSA-9pj6-vhgr-3mwh

high2026-09-16

CVE-2026-63127-RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

View chart →

modelcontextprotocol/rust-sdk · GHSA-33f5-2c5q-wgwj

medium2026-09-16

CVE-2026-61453-Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

View chart →

getgrav/grav · GHSA-2c4f-86xc-cr74

medium2026-09-16

CVE-2026-57173-vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

View chart →

vllm-project/vllm · GHSA-hcwq-8wjf-3gcr

medium2026-09-16

CVE-2026-59193-Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

View chart →

getgrav/grav · GHSA-2vcx-h8p2-9pg9

high2026-09-16

CVE-2026-61599-djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

View chart →

djust-org/djust · GHSA-7prp-2623-8g45

medium2026-09-16

CVE-2026-61589-djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

View chart →

djust-org/djust · GHSA-v9rj-xjfv-xj9r

high2026-09-16

CVE-2026-61596-djust has broken object-level access control (IDOR)

View chart →

djust-org/djust · GHSA-c7c5-5j6r-q957

medium2026-09-16

CVE-2026-61588-djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

View chart →

djust-org/djust · GHSA-pvg3-6q9j-mj3x