Security Advisories

critical2026-09-16

CVE-2026-61594-djust has an authorization bypass on the WebSocket/SSE mount path

djust-org/djust · GHSA-xhhm-f6hp-2qwj

high2026-09-16

CVE-2026-61591-djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

View chart

djust-org/djust · GHSA-c67v-vqrp-m5wj

high2026-09-16

CVE-2026-61592-djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

View chart

djust-org/djust · GHSA-f795-p5jw-j6g2

medium2026-09-16

CVE-2026-61597-djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

View chart

djust-org/djust · GHSA-4mf4-73j6-mvrw

high2026-09-16

CVE-2026-68904-node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

View chart

node-opcua/node-opcua · GHSA-r2pf-9cw4-5j65

high2026-09-16

CVE-2026-61593-djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

View chart

djust-org/djust · GHSA-pg97-jvmf-qfvc

critical2026-09-16

CVE-2025-59953-LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

View chart

internlm/lmdeploy · GHSA-5h8j-6crg-7rmw

high2026-09-16

CVE-2026-61595-djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

View chart

djust-org/djust · GHSA-3492-cvg7-9mr2

high2026-09-16

CVE-2026-61598-djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

View chart

djust-org/djust · GHSA-cc7c-9jff-58wj

high2026-09-16

CVE-2026-81192-OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

View chart

open-telemetry/opentelemetry-dotnet-contrib · GHSA-v8pv-4842-x354

high2026-09-16

CVE-2026-61590-djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

View chart

djust-org/djust · GHSA-8g2f-g3gq-5rjv

critical2026-09-16

CVE-2026-61560-@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

View chart

zereight/gitlab-mcp · GHSA-cv3r-c5h8-f4g5

critical2026-09-15

CVE-2026-61559-@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

View chart

zereight/gitlab-mcp · GHSA-2h44-8472-frjj

critical2026-09-15

CVE-2026-61568-@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

View chart

zereight/gitlab-mcp · GHSA-vmp7-252j-cwp7

high2026-09-15

@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS

View chart

zereight/gitlab-mcp · GHSA-5648-rgj9-v224

high2026-09-15

CVE-2026-61554-emp3r0r has an unauthenticated HTTP Polling DoS

View chart

jm33-m0/emp3r0r · GHSA-4595-rvpx-4q34

high2026-09-15

CVE-2026-88975-Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE

View chart

http4s/http4s · GHSA-gq9p-f254-h286

high2026-09-15

CVE-2026-61544-libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

View chart

libp2p/rust-libp2p · GHSA-5hq8-qhww-jm7q

medium2026-09-15

CVE-2026-69201-Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

View chart

http4s/http4s · GHSA-crq5-92j2-j7wv

high2026-09-15

CVE-2026-69218-Http4s Ember HTTP/2: unbounded continuation frame accumulation

View chart

http4s/http4s · GHSA-cp4q-fqw9-4hf6