Security advisories

high2026-09-09

CVE-2026-59185-Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification

View chart →

identrail/identrail · GHSA-cp3j-m783-3ph5

high2026-09-09

CVE-2026-59179-@openhop/server: Path Traversal in Flow ID File Operations

View chart →

naorsabag/openhop · GHSA-g72f-jw3w-mgh7

high2026-09-09

CVE-2026-59177-ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

View chart →

esphome/device-builder · GHSA-vv4j-m4vr-f3g6

high2026-09-09

CVE-2026-59176-functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

View chart →

jordanburke/functype · GHSA-wcjj-9m6g-2fr2

high2026-09-09

CVE-2026-59172-Joker linter executed project-local .jokerd/linter.* files during linting

View chart →

candid82/joker · GHSA-m835-3cm9-rggg

high2026-09-09

Komari: Management Interface CSRF

View chart →

komari-monitor/komari · GHSA-hxjg-93wc-h8p8

high2026-09-09

CVE-2026-59160-@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

View chart →

deryeger/yeger · GHSA-2r5q-h53f-9rp3

high2026-09-09

CVE-2026-59158-Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

View chart →

thoda-dev/nuxt-ollama · GHSA-fxg7-897c-57mp

medium2026-09-09

CVE-2026-59157-webhookd: Unrestricted HTTP Header to Shell Variable Injection

View chart →

ncarlier/webhookd · GHSA-v25g-mvwr-f5fp

high2026-09-09

CVE-2026-55864-GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool

View chart →

geonetwork/core-geonetwork · GHSA-5hx7-j24v-rffj

high2026-09-09

CVE-2026-85730-smol-toml: Denial of Service via malformed TOML documents

View chart →

squirrelchat/smol-toml · GHSA-7w5x-hrqm-74c2

medium2026-09-09

CVE-2026-55073-weasyprint Has Server-Side Request Forgery (SSRF)

View chart →

kozea/weasyprint · GHSA-jf6q-chmf-3h3v

medium2026-09-09

CVE-2026-54529-SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

View chart →

smithyhq/sqladmin · GHSA-ccg5-9c8w-xh6v

medium2026-09-09

CVE-2026-53495-containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service

View chart →

containerd/containerd · GHSA-7jxh-36q5-gcqv

medium2026-09-09

CVE-2026-50024-GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

View chart →

wangyihang/githacker · GHSA-hr3m-4qwq-3mgc

medium2026-09-09

CVE-2026-44282-decidim-elections: Election question titles allow stored script execution

View chart →

decidim/decidim · GHSA-9mvp-w4rr-5c6x

medium2026-09-09

CVE-2025-58363-LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint

View chart →

lf-edge/ekuiper · GHSA-c23q-fw86-9h5x

medium2026-09-09

CVE-2025-24979-LF Edge eKuiper: SSRF in External Service

View chart →

lf-edge/ekuiper · GHSA-pqqc-8v73-9gg2

low2026-09-09

CVE-2025-24978-LF Edge eKuiper: Self-XSS in External Service Creation

View chart →

lf-edge/ekuiper · GHSA-g8rh-fjm6-h2h9

medium2026-09-09

CVE-2025-24890-gix-sec safe.directory protections absent for elevated administrators

View chart →

gitoxidelabs/gitoxide · GHSA-7rhf-42qf-vrvc