Security Advisories

critical2026-08-28

CVE-2026-55634-Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

pimcore/pimcore · GHSA-9x44-4gxf-8c25

critical2026-08-28

CVE-2026-55220-Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

View chart

pimcore/pimcore · GHSA-w23p-wrp7-ch38

high2026-08-28

CVE-2026-55212-Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

View chart

pimcore/pimcore · GHSA-f97c-ph8j-8vff

high2026-08-28

CVE-2026-55208-Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes

View chart

pimcore/pimcore · GHSA-79cw-hfcc-7mw9

high2026-08-28

CVE-2026-55207-Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

View chart

pimcore/pimcore · GHSA-h854-c3m3-mh5v

high2026-08-28

CVE-2026-55215-MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`

View chart

mariadb-corporation/mariadb-connector-nodejs · GHSA-cqhc-2h57-wpxf

critical2026-08-28

CVE-2026-55247-plone.app.event vulnerable to denial of service via iCalendar import

View chart

plone/plone.app.event · GHSA-r82h-mqw3-fc56

high2026-08-28

CVE-2026-55622-Incus has a project restriction bypass in instance copy across projects

View chart

lxc/incus · GHSA-c9f5-j9c3-mhrg

high2026-08-28

CVE-2026-55621-Incus has a project restriction bypass for custom volume copy across projects

View chart

lxc/incus · GHSA-64f3-v33m-w89f

high2026-08-28

CVE-2026-55228-Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project

View chart

weblateorg/weblate · GHSA-2q2q-jr9g-v9rf

medium2026-08-28

CVE-2026-55227-Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups

View chart

weblateorg/weblate · GHSA-2p9g-x3cv-5hh4

high2026-08-28

CVE-2026-55520-Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

View chart

scrapy/protego · GHSA-wjmf-p669-5m5p

critical2026-08-28

CVE-2026-55248-plone.app.portlets vulnerable to denial of service via RSS feed portlet

View chart

plone/plone.app.portlets · GHSA-x5g3-w747-2h8q

high2026-08-28

CVE-2026-55673-PowSyBl Core has Command Injection in LocalCommandExecutor-s

View chart

powsybl/powsybl-core · GHSA-jqvf-j3ww-r8c7

high2026-08-28

CVE-2026-55175-Spinnaker: Improper yaml processing on kustomize bake operations

View chart

spinnaker/spinnaker · GHSA-p68j-q7hf-3qcp

medium2026-08-28

CVE-2026-55407-Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation

View chart

anthropics/buffa · GHSA-f9qc-qg88-7pq5

medium2026-08-28

CVE-2026-55406-Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

View chart

anthropics/buffa · GHSA-9pwq-gcrx-wghh

high2026-08-28

CVE-2026-55641-9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

View chart

decolua/9router · GHSA-86m2-fcxq-5q7c

high2026-08-28

CVE-2026-55638-9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

View chart

decolua/9router · GHSA-8gmq-j984-vp4r

high2026-08-28

CVE-2026-55584-phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

View chart

phpsysinfo/phpsysinfo · GHSA-786w-p5pm-cvgh