Unspecified security issues.

CPANSA-MySQL-Admin-1-1

Unspecified security issues.

cpan

No PRs yet

Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

GHSA-p9jm-q85p-7mcp CVE-2026-56818 MODERATE about 1 hour ago

## Summary `RedisArrayAggregator` clears retained partial aggregate state when the `maxNestedArrayDepth` limit is exceeded, but it does not clear ...

maven

No PRs yet

API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

GHSA-9rjg-x2p2-h68h CVE-2026-54164 MODERATE about 2 hours ago

## Summary The API Platform serializer's `AbstractItemNormalizer` does not validate the resource type returned when resolving relation IRIs, allow...

packagist

No PRs yet

SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

GHSA-29g2-3rmr-qm68 CVE-2026-66062 MODERATE about 2 hours ago

### Impact SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted `Accept` headers. The impact is mitigated by defau...

npm

No PRs yet

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

GHSA-7c4v-fwgw-9rf7 MODERATE about 2 hours ago

### Impact When a Nuxt dev server is bound to a network-reachable interface (for example `nuxt dev --host` for on-device testing), the default-ena...

npm

No PRs yet

Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation

EEF-CVE-2026-67585 GHSA-55hv-mwvr-phf3 CVE-2026-67585 HIGH about 2 hours ago

## Summary Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe\_federation allows an unauthenticated remote ...

hex

No PRs yet

go-git: Malicious reference names may modify files outside the reference storage

GHSA-qgq7-7hm3-q39j CVE-2026-71557 MODERATE about 2 hours ago

### Impact A path traversal issue in `go-git` could allow malicious reference names to access files outside the repository's intended reference sto...

go

No PRs yet

go-git: Worktree operations may follow symlinks

GHSA-hc8v-wwc9-vgxm CVE-2026-71556 HIGH about 2 hours ago

## Impact A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path. The `worktree...

go

No PRs yet

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

GHSA-wvpp-8hx9-p66j HIGH about 3 hours ago

## Summary The `check_unsafe_options` guard can be bypassed on every guarded method (clone/clone_from, fetch/pull/push, ls_remote, iter_commits, bl...

pypi

No PRs yet

GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

GHSA-jm78-9fvv-mhgr HIGH about 3 hours ago

## Summary GitPython's config-name validator only neutralizes CR/LF/NUL for the `"option"` label; it does not reject `=`, `#`, `;`, `[`, `]`, or wh...

pypi

No PRs yet

GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

GHSA-hmq2-w58f-27jc HIGH about 3 hours ago

### Summary GitPython computes the on-disk location of a submodule's separate Git directory (`.git/modules/<name>`) from the submodule's `.gitmodul...

pypi

No PRs yet

GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

GHSA-hh9p-6wh2-4mfc MODERATE about 3 hours ago

## Summary `IndexFile.remove()` and `Head.checkout()` forward `**kwargs` into `git rm` and `git checkout` with no guard. Passing `--pathspec-from-...

pypi

No PRs yet

GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

GHSA-9rj7-rf2p-w77r HIGH about 3 hours ago

## Summary `Repo.init()` forwards `**kwargs` verbatim to `git init` with no unsafe-option guard and no `allow_unsafe_options` parameter. `git init ...

pypi

No PRs yet

GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

GHSA-4gmw-gg2m-w46p HIGH about 3 hours ago

## Summary `IndexFile.from_tree`, `IndexFile.reset` (→ from_tree) and `IndexFile.merge_tree` append caller-influenced treeish strings positionally ...

pypi

No PRs yet

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

GHSA-55q2-fjhq-7xh7 MODERATE about 3 hours ago

### Summary During `IN_PLACE` sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant ...

npm

No PRs yet

Smarty Security stream restriction bypass through stream: resource

GHSA-rjhh-76wf-8xmw CVE-2026-62996 MODERATE about 4 hours ago

`smarty/smarty` version `5.8.0` can read local files through PHP stream wrappers even when Smarty Security is enabled and all streams are disabled ...

packagist

No PRs yet

Smarty: Symlink path traversal out of trusted directories

GHSA-f6wf-28g6-769x CVE-2026-62992 MODERATE about 4 hours ago

When Smarty's Security policy is enabled, secure_dir (and the configured template/trusted directories) restrict which local files a template may re...

packagist

No PRs yet

Craft CMS: Passkey login accepts replayed WebAuthn assertions

GHSA-wg23-69c2-gjc8 CRITICAL about 4 hours ago

Craft CMS passkey login accepts WebAuthn requestOptions from the unauthenticated login request body and does not persist the updated credential cou...

packagist

No PRs yet

SQL injection via the :comment option in Postgrex.stream/4

EEF-CVE-2026-66838 GHSA-3gww-3f36-2388 CVE-2026-66838 MEDIUM about 6 hours ago

## Summary Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL I...

hex

No PRs yet

Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

GHSA-957r-qf9p-67xw MODERATE about 21 hours ago

The `create()` Twig function (introduced in 5.9.0) allows instantiation of arbitrary PHP classes from template code, restricted only by a 5-entry b...

packagist

No PRs yet

h2: Duplicate Host header could facilitate request smuggling

GHSA-6hr6-w5qg-qmwg CVE-2026-71554 MODERATE about 21 hours ago

### Impact h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming applicati...

pypi

No PRs yet

Craft CMS: Authenticated leak of secret environment variables

GHSA-596p-6jv8-775v MODERATE about 21 hours ago

Environment variables and secrets are interpolated into a Twig template even when the Twig sandbox is enabled, allowing them to be leaked by an aut...

packagist

No PRs yet

Craft CMS:Authorization bypass: view-only Categories user can modify category structure via structures/move-element

GHSA-xxpx-f366-4xpq MODERATE about 21 hours ago

A control-panel user who holds only the viewCategories permission for a category group (and not saveCategories) can permanently modify that group's...

packagist

No PRs yet

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

GHSA-rvmm-v933-jgxq MODERATE about 21 hours ago

`ChartsController::actionGetNewUsersData()` at `/actions/charts/get-new-users-data` is missing a `requirePermission('viewUsers')` authorization che...

packagist

No PRs yet

Craft CMS: Incorrect path validation could potentially lead to path traversal

GHSA-7hxc-f267-h5q7 LOW about 21 hours ago

The `ensurePathIsContained` function of the `Local` file system class is theoretically vulnerable to path traversal, although no exploitable scenar...

packagist

No PRs yet

Craft CMS: Stored XSS in the control panel via unescaped draft name

GHSA-2rp4-x2j7-qmcc MODERATE about 21 hours ago

The control-panel helper that renders element chip/card labels writes an element's `draftName` into the page without HTML-encoding it, while the su...

packagist

No PRs yet

PHP_CodeSniffer gitblame report command injection via crafted filename

GHSA-hmqg-cxww-wqhq CVE-2026-67434 HIGH about 21 hours ago

### Impact PHP_CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the `Gitblame`, `Hgbl...

packagist

1

Dependabot PRs

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

GHSA-j4r3-hg7j-8chg CVE-2026-71498 MODERATE about 21 hours ago

## Summary `re2` infers a character's byte length from its UTF-8 lead byte alone, with no bound on the bytes actually remaining in the input. `Buf...

npm

No PRs yet

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

GHSA-8hcv-x26h-mcgp CVE-2026-71430 MODERATE about 21 hours ago

## Description `WrappedRE2::Replace` builds the replacement result and hands it to V8 with `.ToLocalChecked()` **without checking for the empty `M...

npm

No PRs yet

ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

GHSA-w9hm-4m3m-fxmm HIGH about 21 hours ago

ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency s...

npm

No PRs yet

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

GHSA-hq66-cqwq-w95j CVE-2026-16633 HIGH about 21 hours ago

### Impact If PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (which is the default value) and...

npm

No PRs yet

jsoup: Cleaner may expose markup with custom raw-text elements

GHSA-pmhh-3w7g-xqp8 CVE-2026-71497 MODERATE about 22 hours ago

When a custom `Safelist` permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a cont...

maven

1

Dependabot PRs

Craft CMS: Arbitrary user password reset leading to administrator account takeover

GHSA-p8x7-9vfw-p7vc HIGH about 22 hours ago

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated se...

packagist

No PRs yet

Craft CMS: Authenticated RCE through Twig sandbox escape

GHSA-f5wm-88jv-g5hx HIGH about 22 hours ago

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE in a ma...

packagist

No PRs yet

Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

GHSA-9p7c-v5x3-rfx8 CVE-2026-14793 MODERATE about 22 hours ago

The `reorder-sets` action in Craft CMS’s `GlobalsController` is missing the `requireAdmin()` check that the adjacent `save-set` and `delete-set` ac...

packagist

No PRs yet

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

GHSA-265m-7826-wjqm HIGH about 22 hours ago

Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craft cleans the outer request-...

packagist

No PRs yet

league/commonmark: Denial of service via deeply nested XML output

GHSA-mj63-m3rc-8ppr MODERATE about 22 hours ago

### Impact `XmlRenderer` pretty-prints XML by emitting depth-proportional indentation whitespace for **every** opening and closing tag. For a tree...

packagist

No PRs yet

league/commonmark: Denial of service via colliding heading slugs

GHSA-mh25-x5hq-wrqp HIGH about 22 hours ago

### Impact `UniqueSlugNormalizer::normalize()` makes each slug document-unique by searching for an unused numeric suffix, but **restarts that sear...

packagist

No PRs yet

league/commonmark: Denial of service via duplicate footnote definitions

GHSA-jfm3-95jq-q3rf HIGH about 22 hours ago

### Impact The Footnote extension records one backref per footnote *reference* and then appends the **entire** backref list for **every** footnote...

packagist

No PRs yet

league/commonmark: Denial of service via adjacent inline attribute blocks

GHSA-g2gp-3wwq-f4ph HIGH about 22 hours ago

### Impact With the Attributes extension enabled, `AttributesListener::findTargetAndDirection()` resolves each attribute node's target by walking ...

packagist

No PRs yet

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

GHSA-2q4p-g7hv-5rgv CVE-2026-71488 HIGH about 22 hours ago

### Impact Affected versions of `league/commonmark` can have quadratic time complexity when parsing specially crafted Markdown lines. In practical...

packagist

No PRs yet

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

GHSA-29pj-957v-52mc CVE-2026-71478 MODERATE about 22 hours ago

## Summary The `AttributesExtension`'s `href`/`src` unsafe-link filter (`AttributesHelper::filterAttributes()`) can be bypassed by embedding cont...

packagist

No PRs yet

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

GHSA-5p4m-2wfm-xmqj HIGH about 22 hours ago

# Quadratic CPU consumption in `!!omap` resolution (js-yaml 3.x and 4.x) ## Summary `resolveYamlOmap()` enforces key uniqueness for `!!omap` sequ...

npm

No PRs yet

Silverstripe: XSS in breadcrumbs in page list view

GHSA-w3cp-g2pf-65wh CVE-2026-54717 MODERATE about 22 hours ago

### Impact Page breadcrumbs in the CMS are vulnerable to XSS when viewed using the page list view ### Reporter Fase Rais Baradika

packagist

No PRs yet

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

GHSA-hqvf-45jj-mccq CVE-2026-18654 MODERATE about 22 hours ago

### Summary The AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. An issue exists where the EMR ...

pypi

No PRs yet

Nx: Zip-Slip in the self-hosted remote cache

GHSA-vp3h-ghgh-jr7g CVE-2026-71476 HIGH about 23 hours ago

## Summary The Nx **self-hosted HTTP remote cache** extracts downloaded cache artifacts without constraining where files are written. A malicious ...

npm

No PRs yet

Mermaid radar diagrams are vulnerable to DoS

GHSA-rhh3-jpg6-66xh CVE-2026-71439 MODERATE about 23 hours ago

### Impact Mermaid radar diagrams allow arbitrary large values for `ticks`, which can cause high CPU usage, freezing the webpage/JavaScript proces...

npm

No PRs yet

Mermaid configuration APIs allow prototype pollution

GHSA-c4c3-pg64-4m4v CVE-2026-71438 LOW about 23 hours ago

### Summary Mermaid's configuration setters (`mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig`) merge the caller-sup...

npm

12

Dependabot PRs

Mermaid allows CSS injection applying to sibling elements of the diagram

GHSA-6x64-9x62-f2gx CVE-2026-50159 MODERATE about 23 hours ago

### Summary Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with `#mermaid-X`, sibling (`~` and `...

npm

No PRs yet

Mermaid Architecture diagrams are vulnerable to prototype pollution

GHSA-3rrr-jr9j-h3q3 CVE-2026-71437 MODERATE about 23 hours ago

Rendering an untrusted `architecture-beta` diagram lets the diagram author write an arbitrary property with the value `horizontal` or `vertical` on...

npm

No PRs yet