Security Advisories

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so ...

CPANSA-Mojo-JWT-2026-9537 CVE-2026-9537 13 days ago

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the suppli...

cpan

No PRs yet

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six...

CPANSA-GD-SecurityImage-2026-13082 CVE-2026-13082 13 days ago

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA b...

cpan

No PRs yet

Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability between the Dance...

CPANSA-Dancer-Plugin-Auth-Google-2026-13410 CVE-2026-13410 13 days ago

Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_...

cpan

No PRs yet

ArcadeDB has cross-database IDOR: /ts/, /batch/, Prometheus and Grafana handlers bypass authorization

GHSA-x8mg-6r4p-87pf HIGH 13 days ago

About 14 HTTP handlers resolve the {database} path param and call getDatabase(...) WITHOUT user.canAccessToDatabase(...) and without setting the en...

maven

No PRs yet

ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

GHSA-vwjc-v7x7-cm6g HIGH 13 days ago

The GHSA-48qw-824m-86pr hardening added a checkPermissionsOnDatabase(UPDATE_SECURITY) gate on the polyglot engine (PolyglotQueryEngine.java:112-114...

maven

1

Dependabot PRs

ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

GHSA-x9f9-r4m8-9xc2 HIGH 13 days ago

ScriptTriggerExecutor sets allowedPackages to java.lang.*, java.util.*, java.time.*, java.math.* (ScriptTriggerExecutor.java:56); trigger creation ...

maven

No PRs yet

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

GHSA-vj7q-gjh5-988w CVE-2026-59950 HIGH 13 days ago

### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handsh...

pypi

No PRs yet

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

GHSA-48qw-824m-86pr HIGH 13 days ago

### Impact A user holding only `reader` (read-only) privileges on a single database could execute arbitrary JVM code by sending a `"language": "js...

maven

No PRs yet

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

GHSA-p4h7-p9rj-2pq2 CVE-2026-55579 CRITICAL 13 days ago

### Summary Pheditor ships with a hardcoded default password `admin` (SHA-512 hash stored at `pheditor.php:11`). There is no mechanism to force a ...

packagist

No PRs yet

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

GHSA-wg4w-wr5q-6vjc CVE-2026-55578 HIGH 13 days ago

### Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to `she...

packagist

No PRs yet

kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

GHSA-wvmp-6r4v-j6cv CVE-2026-52724 MODERATE 13 days ago

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verifi...

go

No PRs yet

ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

GHSA-vg6x-6pg9-6qwg CVE-2026-54076 HIGH 13 days ago

### Impact The fix for CVE-2026-44221 (GHSA-fxc7-fm93-6q77) added an `UPDATE_SCHEMA` authorization check to a single schema-mutating method (`Loca...

maven

No PRs yet

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

GHSA-8w86-m9h8-hvqg CVE-2026-54077 HIGH 13 days ago

### Impact The SQL `IMPORT DATABASE` statement did not require administrative privileges and passed its source URL to the importer without validat...

maven

No PRs yet

nimiq-primitives: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

GHSA-5rg2-xv9j-gv5p CVE-2026-54542 LOW 13 days ago

### Impact A malicious peer acting as a state-sync source can crash a syncing node with a crafted `TrieChunk` whose proof contains a `TrieNodeChil...

cargo

No PRs yet

nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys

GHSA-46wq-28cx-mhw4 CVE-2026-54541 LOW 13 days ago

### Impact A malicious peer acting as a state-sync source can crash a syncing node by sending a crafted `TrieChunk` whose proof contains two `Trie...

cargo

No PRs yet

Pheditor has an authenticated terminal command whitelist bypass

GHSA-9643-6xjp-vx57 CVE-2026-54540 HIGH 13 days ago

### Summary Pheditor 2.0.4 has an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command star...

packagist

No PRs yet

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

GHSA-jpw9-pfvf-9f58 CVE-2026-52869 HIGH 13 days ago

### Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the s...

pypi

No PRs yet

MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

GHSA-hvrp-rf83-w775 CVE-2026-52870 HIGH 13 days ago

### Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) d...

pypi

No PRs yet

Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

GHSA-wpcj-rmv4-86qg CVE-2026-52832 MODERATE 13 days ago

## Summary Nuclio Dashboard exposes `POST /api/functions` without authentication by default (NOP auth mode). The `spec.handler` field (e.g., `mymo...

go

No PRs yet

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

GHSA-3v79-m2cg-89ww CVE-2026-52833 HIGH 13 days ago

## Summary Nuclio's Java runtime generates a `build.gradle` file during function builds using Go's `text/template` package. The template renders `...

go

No PRs yet

Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode

GHSA-22xc-xg2r-9j7v CVE-2026-53714 HIGH 13 days ago

### Impact When Envoy Gateway runs in GatewayNamespaceMode (`provider.kubernetes.deploy.type=GatewayNamespace`), the xDS gRPC server is configured ...

go

No PRs yet

Diesel has possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`

GHSA-ggxf-9f6j-w742 MODERATE 13 days ago

Diesel allows loading a SQLite database from a byte buffer, represented as `&[u8]`, at runtime via the `SqliteConnection::deserialize_readonly_data...

cargo

No PRs yet

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

GHSA-wcrf-9vrr-854f CVE-2026-53713 CRITICAL 13 days ago

### Impact The `to_absolute_normalized_path` function (security.lua:28-43) does not collapse redundant path separators (// → /). On Linux, `//etc/...

go

No PRs yet

Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock

GHSA-8fv2-88gg-hm7q CVE-2026-53715 MODERATE 13 days ago

Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):** - Pod-network reachabilit...

go

No PRs yet

Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header

GHSA-h7pq-86h8-rp5x CVE-2026-53717 MODERATE 13 days ago

Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):** - Tenant can create Envoy...

go

No PRs yet

Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

GHSA-m2v6-2jmh-4c68 CVE-2026-53719 MODERATE 13 days ago

Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):** - Tenant has SecurityPoli...

go

No PRs yet

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

GHSA-cxpq-8v7q-cg56 CVE-2026-53716 MODERATE 13 days ago

Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):** - Tenant can create Envoy...

go

No PRs yet

Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

GHSA-fcrp-7gc2-93g7 CVE-2026-53718 MODERATE 13 days ago

### Impact Envoy Gateway accepts extension-managed custom backendRefs from an HTTPRoute to a backend resource in another namespace without requirin...

go

No PRs yet

kumactl connects to control plane without verifying TLS certificate when no CA is configured

GHSA-v95x-xhq5-4929 CVE-2026-50166 MODERATE 13 days ago

When an operator adds an HTTPS control plane profile to `kumactl` without providing a CA certificate, `kumactl` disables TLS verification and sends...

go

No PRs yet

Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

EEF-CVE-2026-59249 GHSA-x3x7-96vm-6h2w CVE-2026-59249 MEDIUM 14 days ago

## Summary Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 serv...

hex

No PRs yet

Image::Epeg versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::Epeg includes Epeg 0.9.0 that was last updated in 2004. Epeg is a fast JPEG thumbnail library that was once part of the Enlightenment Project.

CPANSA--2026-3031 CVE-2026-3031 14 days ago

Image::Epeg versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::Epeg includes Epeg 0.9.0 that was last updated...

cpan

No PRs yet

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within...

CPANSA-HTML-Bare-2026-57073 CVE-2026-57073 14 days ago

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter s...

cpan

No PRs yet

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attr...

CPANSA-HTML-Bare-2026-13397 CVE-2026-13397 14 days ago

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advanc...

cpan

No PRs yet

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within ...

CPANSA-XML-Bare-2026-57074 CVE-2026-57074 14 days ago

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter st...

cpan

No PRs yet

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attri...

CPANSA-XML-Bare-2026-13401 CVE-2026-13401 14 days ago

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advance...

cpan

No PRs yet

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-te...

CPANSA-YAML-Syck-2026-57077 CVE-2026-57077 14 days ago

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_...

cpan

No PRs yet

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node->anchor, freed when ...

CPANSA-YAML-Syck-2026-57076 CVE-2026-57076 14 days ago

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In...

cpan

No PRs yet

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec. The base64 decoder in the bundled libsyck indexes the 256-entry static table b64_xtable with a signed char, so any !!binary by...

CPANSA-YAML-Syck-2026-57075 CVE-2026-57075 14 days ago

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec. The base64 decoder in...

cpan

No PRs yet

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_rem...

CPANSA-YAML-Syck-2026-13713 CVE-2026-13713 14 days ago

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In...

cpan

No PRs yet

ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

GHSA-pr64-jmmf-jp54 CVE-2026-58196 LOW 14 days ago

# Security Advisory: SSRF in remote MCP server authentication discovery **Severity:** High. **CWE:** CWE-918. **Affected:** ToolHive through the l...

go

No PRs yet

adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files

GHSA-xg43-5579-qw6v MODERATE 14 days ago

### Impact `adawolfa/isdoc` reads ISDOC invoices from ISDOCX (ZIP) archives and from PDF files with embedded ISDOC documents and supplements. Affe...

packagist

No PRs yet

@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

GHSA-6f5r-5672-72j7 CVE-2026-54504 HIGH 14 days ago

### Summary `@andrea9293/mcp-documentation-server` v1.13.0 documents that a Web UI starts automatically on port `3080`. However, the Web UI/API ap...

npm

No PRs yet

systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

GHSA-5xpp-75jx-m839 CVE-2026-50289 HIGH 14 days ago

### Summary On Linux, `systeminformation`'s `networkInterfaces()` is vulnerable to OS command injection through the Debian/Ubuntu `interfaces(5)` ...

npm

No PRs yet

Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

GHSA-ggw3-5987-rx77 CVE-2026-50285 HIGH 14 days ago

## Summary The HPKE V2 URL decode path in `pkg/hpke/url.go` decompresses attacker-controlled zstd data without any size limit. On Pomerium deploym...

go

No PRs yet