Security Advisories

critical2026-09-11

CVE-2026-61534-yayson: Prototype pollution in Store/LegacyStore deserialization

confetti/yayson · GHSA-325j-mg25-8q58

high2026-09-11

CVE-2026-59148-@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

View chart

mockoon/mockoon · GHSA-rqx4-3f6q-3x2v

medium2026-09-11

CVE-2026-59149-@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

View chart

mockoon/mockoon · GHSA-8wqc-v2q8-vff2

high2026-09-11

CVE-2026-59973-FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

View chart

agentfront/frontmcp · GHSA-65h7-9wrw-629c

critical2026-09-11

CVE-2026-59151-Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

View chart

prowler-cloud/prowler · GHSA-h8m9-jgf8-vwvp

medium2026-09-11

CVE-2026-56665-ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

View chart

zitadel/zitadel · GHSA-v77h-2w3m-94hx

high2026-09-11

CVE-2026-56825-Shopper: Missing authorization on product removal actions in CollectionProducts component

View chart

shopperlabs/shopper · GHSA-2cg9-97gq-9mqp

medium2026-09-11

CVE-2026-56830-Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

View chart

shopperlabs/shopper · GHSA-99h5-jhh7-v3r3

high2026-09-11

CVE-2026-56829-Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

View chart

shopperlabs/shopper · GHSA-g3f9-g5vj-p62f

high2026-09-11

CVE-2026-56828-Shopper: privilege escalation via improper Livewire admin component authorization

View chart

shopperlabs/shopper · GHSA-j328-xmgp-j4q3

medium2026-09-11

CVE-2026-56826-Shopping privilege escalation through missing authorization in Settings components

View chart

shopperlabs/shopper · GHSA-f7h9-qv4x-9x57

medium2026-09-11

CVE-2026-56831-Shopper: Negative discount values accepted and propagated through order calculation pipeline

View chart

shopperlabs/shopper · GHSA-5vf4-452p-jjhf

high2026-09-11

CVE-2026-56827-Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

View chart

shopperlabs/shopper · GHSA-243p-f3cv-c5wh

high2026-09-11

CVE-2026-11745-Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

View chart

line/centraldogma · GHSA-vjfw-cpmh-xwv3

critical2026-09-11

CVE-2026-11746-Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

View chart

line/centraldogma · GHSA-2j95-gqxf-v3vg

medium2026-09-11

CVE-2026-11748-Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion

View chart

line/centraldogma · GHSA-98q5-5qh2-7w75

critical2026-09-11

CVE-2026-59971-MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

View chart

designcomputer/mysql_mcp_server · GHSA-rqfv-2mw9-78g2

medium2026-09-10

CVE-2026-88006-Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

View chart

open-webui/open-webui · GHSA-wvm9-9g5j-623f

high2026-09-10

CVE-2026-88008-Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

View chart

traefik/traefik · GHSA-w4v4-9rw7-5326

high2026-09-10

CVE-2026-88004-Traefik entrypoint header-name sanitization bypassed via request trailers

View chart

traefik/traefik · GHSA-v67p-phpq-fc8x