Security advisories

high2026-09-08

CVE-2026-83614-xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

View chart →

xmldom/xmldom · GHSA-93r5-fhx6-vmg9

high2026-09-08

CVE-2026-83612-xmldom: HTML raw-text closing-tag case mismatch causes output amplification

View chart →

xmldom/xmldom · GHSA-6mj3-qw4j-hgrw

critical2026-09-08

CVE-2026-84372-Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

View chart →

predis/predis · GHSA-w6f5-v2h6-g786

critical2026-09-08

CVE-2026-77635-CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

View chart →

cakephp/cakephp · GHSA-fxf7-vhh8-7vpq

high2026-09-08

CVE-2026-77634-CakePHP: SmtpTransport vulnerable to CRLF header injection

View chart →

cakephp/cakephp · GHSA-2qh5-382h-3jpc

low2026-09-08

CVE-2026-84368-joi: Prototype pollution via a `__proto__` language key in custom messages

View chart →

hapijs/joi · GHSA-6w3j-5fw6-r9vr

medium2026-09-08

CVE-2026-85062-Colord: Slow rejection of oversized malformed color strings

View chart →

omgovich/colord · GHSA-2wm5-q62r-hmrv

critical2026-09-08

CVE-2026-75604-Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

View chart →

vercel/next.js · GHSA-p293-qw3h-jr36

low2026-09-08

CVE-2026-84367-joi: object().rename() with a template target can set the validated object's prototype

View chart →

hapijs/joi · GHSA-gg4h-3hg2-grpc

critical2026-09-08

CVE-2026-85061-MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

View chart →

maplibre/maplibre-gl-js · GHSA-jrc7-96c5-q579

medium2026-09-08

CVE-2026-84303-gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

View chart →

grpc/grpc-go · GHSA-qc2q-p7wx-3px3

high2026-09-08

CVE-2026-84382-HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

View chart →

pydantic/httpx2 · GHSA-8xx6-hgc6-gc2m

medium2026-09-08

CVE-2026-84373-Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

View chart →

vitest-dev/vitest · GHSA-82fw-gwwq-j7x9

medium2026-09-08

CVE-2026-84380-HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

View chart →

pydantic/httpx2 · GHSA-pf96-p4fj-6566

medium2026-09-08

CVE-2026-84379-HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

View chart →

pydantic/httpx2 · GHSA-h4x7-gw46-3wm6

medium2026-09-08

CVE-2026-84378-HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

View chart →

pydantic/httpx2 · GHSA-f2fp-rgf2-35cp

high2026-09-08

CVE-2026-84381-HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

View chart →

pydantic/httpx2 · GHSA-7mj9-2mp8-4m2p

medium2026-09-08

CVE-2026-73560-vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

View chart →

vllm-project/vllm · GHSA-4hhp-h66f-j5j7

high2026-09-08

CVE-2026-84374-Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

View chart →

spartnernl/laravel-excel · GHSA-c7r6-vx3h-w5g2

high2026-09-08

CVE-2026-83606-xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

View chart →

xmldom/xmldom · GHSA-g53g-w8rj-fmg7