Security advisories

medium2026-09-02

CVE-2026-63435-Mail: Email address spoofing via malformed RFC 2047 encoded-words

View chart →

mikel/mail · GHSA-mvxr-6m87-mv2q

high2026-09-02

CVE-2026-62669-Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

View chart →

getgrav/grav · GHSA-7mgc-c7pq-3rr3

high2026-09-02

CVE-2026-62677-Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

View chart →

omnigent-ai/omnigent · GHSA-p8rw-8qj3-hf33

critical2026-09-02

CVE-2026-62674-Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE

View chart →

omnigent-ai/omnigent · GHSA-jrrm-9hc7-2v3h

high2026-09-02

CVE-2026-62675-Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools

View chart →

omnigent-ai/omnigent · GHSA-756x-9hf6-q4h4

medium2026-09-02

CVE-2026-61842-Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

View chart →

getgrav/grav · GHSA-mc5q-6hpj-rp7j

medium2026-09-02

CVE-2026-61690-Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

View chart →

getgrav/grav · GHSA-928x-9mpw-8h56

high2026-09-02

CVE-2026-61704-link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

View chart →

op-engineering/link-preview-js · GHSA-cpjf-6666-r8fx

high2026-09-02

CVE-2026-75931-fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

View chart →

fastify/fast-uri · GHSA-5jgf-p345-68v8

high2026-09-02

CVE-2026-75975-fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

View chart →

fastify/fast-uri · GHSA-f65p-4m7j-42xc

high2026-09-02

CVE-2026-75899-fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

View chart →

fastify/fast-uri · GHSA-fph4-wmhf-6fwf

high2026-09-02

CVE-2026-76172-fast-uri vulnerable to host confusion via percent-encoded scheme normalization

View chart →

fastify/fast-uri · GHSA-jqff-g426-hqxp

high2026-09-02

CVE-2026-62388-NLTK: Default ENFORCE=False Disables All pathsec Security Controls

View chart →

nltk/nltk · GHSA-p3m8-78j2-g5p3

medium2026-09-02

CVE-2026-63311-NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

View chart →

nltk/nltk · GHSA-3gqm-fcw5-w839

medium2026-09-02

CVE-2026-83610-xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

View chart →

xmldom/xmldom · GHSA-6gmq-8vp8-gcm6

high2026-09-02

CVE-2026-76098-Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

View chart →

lepture/mistune · GHSA-6m44-fpc8-c3rq

medium2026-09-02

CVE-2026-16732-fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

View chart →

fastify/fastify · GHSA-3m5p-2c4r-xxw2

medium2026-09-02

CVE-2026-18504-fastify vulnerable to schema validation bypass via root primitive coercion mismatch

View chart →

fastify/fastify · GHSA-w2qp-rph6-63g4

high2026-09-02

CVE-2026-71553-ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

View chart →

apostrophecms/apostrophe · GHSA-vmg4-6gfg-83qx

medium2026-09-02

CVE-2026-82396-Sulu: Stored XSS via media download inline-disposition override

View chart →

sulu/sulu · GHSA-pp4x-ccxq-6r33