Security Advisories

medium2026-08-28

CVE-2026-55452-Snipe-IT has CSV formula injection in Activity Report export

View chart

grokability/snipe-it · GHSA-whrx-mmgr-gpcf

medium2026-08-28

CVE-2026-55566-Yamcs has DOM XSS in Extension Routing

View chart

yamcs/yamcs · GHSA-9272-wg2r-7xmx

critical2026-08-28

CVE-2026-55565-Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

View chart

yamcs/yamcs · GHSA-c64q-hj4j-375f

critical2026-08-28

CVE-2026-55559-Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

View chart

yamcs/yamcs · GHSA-73mf-m39p-wpm9

high2026-08-28

CVE-2026-55552-Yamcs has Unauthenticated Directory Traversal

View chart

yamcs/yamcs · GHSA-9jg3-g3wh-w9pj

medium2026-08-28

CVE-2026-55549-Yamcs has Reflected XSS in the URL of the Authorize Endpoint

View chart

yamcs/yamcs · GHSA-rxpg-wjf8-qv9c

medium2026-08-28

CVE-2026-55548-Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

View chart

yamcs/yamcs · GHSA-8xjq-pr36-ccgf

medium2026-08-28

CVE-2026-55547-Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration

View chart

yamcs/yamcs · GHSA-cvw4-55pp-3hfq

medium2026-08-28

CVE-2026-55545-Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce

View chart

yamcs/yamcs · GHSA-fwww-cp23-7f5g

high2026-08-28

CVE-2026-55521-Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

View chart

yamcs/yamcs · GHSA-962x-ccwf-8x6p

critical2026-08-28

CVE-2026-55511-Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

View chart

yamcs/yamcs · GHSA-3g44-3m7x-cgg2

critical2026-08-28

CVE-2026-55068-free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

View chart

free5gc/free5gc · GHSA-x8mj-6p3q-g5pp

medium2026-08-28

CVE-2026-55067-Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

View chart

go-vikunja/vikunja · GHSA-569v-q83c-3j3g

high2026-08-28

CVE-2026-55066-Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

View chart

go-vikunja/vikunja · GHSA-5pg6-m483-7vrg

high2026-08-28

CVE-2026-55065-Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key

View chart

go-vikunja/vikunja · GHSA-gg93-x632-9ccv

medium2026-08-28

CVE-2026-55064-Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

View chart

go-vikunja/vikunja · GHSA-44v6-7fxq-vgf4

medium2026-08-28

CVE-2026-54766-Vikunja has a project duplication bypasses write-permission check on the target parent project

View chart

go-vikunja/vikunja · GHSA-f27p-pw2p-9pr4

high2026-08-28

CVE-2026-54788-datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS

View chart

datadog/dd-trace-rs · GHSA-gpwf-4h98-v82q

medium2026-08-28

CVE-2026-55834-Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

View chart

pocket-id/pocket-id · GHSA-2wvm-8mvp-22qv

medium2026-08-28

CVE-2026-55569-Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory

View chart

aquaproj/aqua · GHSA-mf5c-hw34-4hpp