Security advisories

high2026-09-01

CVE-2026-73089-Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

View chart →

browserslist/browserslist · GHSA-c83g-rgw3-j3cx

high2026-09-01

CVE-2026-73088-Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

View chart →

browserslist/browserslist · GHSA-73wf-gq98-2v4g

high2026-09-01

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

View chart →

sidorares/node-mysql2 · GHSA-3f6p-5ww8-9rcr

medium2026-09-01

CVE-2026-62993-Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

View chart →

smarty-php/smarty · GHSA-cq55-c7wv-pxmq

medium2026-09-01

CVE-2026-69127-Kirby: System path exposure from error messages in the REST API

View chart →

getkirby/kirby · GHSA-rf2p-vh74-7vvh

high2026-09-01

CVE-2026-80047-Hugging Face Transformers downloads custom generation code before trust consent

View chart →

huggingface/transformers · GHSA-x9r9-c232-4q39

high2026-09-01

CVE-2026-84218-jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input

View chart →

jolokia/jolokia · GHSA-c9ff-59g8-m36q

medium2026-08-31

MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS

View chart →

sidorares/node-mysql2 · GHSA-rgwj-5xj2-c3m3

high2026-08-31

CVE-2026-71415-Kirby: File upload permissions are not checked during processing of chunk data

View chart →

getkirby/kirby · GHSA-67mx-6wf2-92xp

high2026-08-31

CVE-2026-75594-Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

View chart →

getkirby/kirby · GHSA-9vx2-j98c-p72w

medium2026-08-31

CVE-2026-45822-decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

View chart →

samverschueren/decode-uri-component · GHSA-vcc3-ghjq-m6fr

high2026-08-31

CVE-2026-59724-Socket.IO: Engine.IO WebTransport SID DoS

View chart →

socketio/socket.io · GHSA-gr94-w7qr-f4j3

medium2026-08-31

CVE-2026-81888-@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

View chart →

honojs/middleware · GHSA-fm3f-ch8h-qw8q

high2026-08-31

CVE-2026-81889-elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

View chart →

studio-42/elfinder · GHSA-8x3q-jpjh-qh5c

medium2026-08-31

CVE-2026-15305-TYPO3 CMS - Unrestricted File Upload in Form Framework

View chart →

typo3/typo3 · GHSA-mfqj-cqv3-h7xw

medium2026-08-28

CVE-2026-55855-MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

View chart →

mariadb-corporation/mariadb-connector-nodejs · GHSA-g5xc-5w98-jfvm

high2026-08-28

CVE-2026-55830-RestrictedPython guard hooks can be shadowed via positional-only arguments

View chart →

zopefoundation/restrictedpython · GHSA-ffg3-p8fm-mjx2

medium2026-08-28

CVE-2026-55860-org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

View chart →

mariadb-corporation/mariadb-connector-r2dbc · GHSA-c857-9x2m-cvh2

medium2026-08-28

CVE-2026-55859-org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output

View chart →

mariadb-corporation/mariadb-connector-r2dbc · GHSA-5rqc-86vf-g8r2

medium2026-08-28

CVE-2026-55858-org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

View chart →

mariadb-corporation/mariadb-connector-j · GHSA-xvr9-35cr-46v9