Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

GHSA-2ppx-66jv-wpw5 CVE-2026-54136 MODERATE 20 days ago

### Summary A resource-scoped API token can read script contents outside its allowed path scope via `GET /api/w/{workspace}/scripts/list_search`. ...

cargo

No PRs yet

SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

GHSA-w7cg-whh7-xp28 CVE-2026-54070 HIGH 20 days ago

## Summary `renderPackageREADME` in `kernel/bazaar/readme.go` renders a Bazaar package README from Markdown to HTML with the lute engine and `SetS...

go

No PRs yet

File Browser: Authentication Bypass via Proxy Auth Header Forgery

GHSA-xqp3-jq6g-x3qm CVE-2026-54089 CRITICAL 20 days ago

## Summary When FileBrowser is configured with proxy authentication (`auth.method=proxy`), any unauthenticated attacker who can reach the server d...

go

No PRs yet

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

GHSA-hvr9-72v2-fff3 CVE-2026-54069 CRITICAL 20 days ago

## Summary SiYuan Note's kernel HTTP server unconditionally trusts all `chrome-extension://` origins, granting `RoleAdministrator` access to every...

go

No PRs yet

SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

GHSA-gcm7-57gf-953c CVE-2026-54068 MODERATE 20 days ago

### Summary The `/api/icon/getDynamicIcon` endpoint is explicitly excluded from authentication in SiYuan's kernel router (`router.go`, "不需要鉴权" -- ...

go

No PRs yet

CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources

GHSA-9mqm-qcwf-5qhg MODERATE 20 days ago

### Summary CredSweeper's deep scanner does not enforce `recursive_limit_size` as a hard limit. Several recursive scanners fully decompress or full...

pypi

No PRs yet

Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)

GHSA-h69g-9hx6-f3v4 CVE-2026-54063 HIGH 20 days ago

## Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) ### Summary The `checkSheet()` function in `github.com/xuri/excel...

go

No PRs yet

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

GHSA-h29v-hj44-q8cv CVE-2026-54072 CRITICAL 20 days ago

## Summary The `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `res...

go

No PRs yet

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

GHSA-mvjr-vv3c-w4qv CVE-2026-54067 CRITICAL 20 days ago

### Summary A CSS snippet body containing `</style>` breaks out of its surrounding `<style>` tag when `renderSnippet()` interpolates it via `inser...

go

No PRs yet

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

GHSA-p4m3-mgmm-c664 CVE-2026-54066 HIGH 20 days ago

## Summary The patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the `/export/` route but the **identical root caus...

go

No PRs yet

adm-zip: Crafted ZIP file triggers 4GB memory allocation

GHSA-xcpc-8h2w-3j85 CVE-2026-39244 HIGH 20 days ago

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js l...

npm

6

Dependabot PRs

MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)

GHSA-489g-7rxv-6c8q MODERATE 20 days ago

### Summary GHSA-7r34-79r5-rcc9's fix added `validate_url_for_ssrf`, which resolves the attacker-controlled `X-Atlassian-{Jira,Confluence}-Url` hea...

pypi

No PRs yet

tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies

GHSA-jxj7-g6gm-49j7 CVE-2026-49977 MODERATE 20 days ago

### Summary tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could cr...

npm

No PRs yet

libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

GHSA-cwc9-cp4j-mcvv CVE-2026-49866 HIGH 20 days ago

### Summary gossipsub processes IHAVE and IWANT control messages by iterating every received message ID synchronously before doing anything with th...

npm

No PRs yet

Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

GHSA-pj8j-p4g4-4vw8 CVE-2026-49865 MODERATE 20 days ago

### Summary Kimai 2.56.0 contains a server-side request forgery vulnerability in its invoice PDF preview and generation workflow. If an attacker c...

packagist

No PRs yet

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

GHSA-4vj7-5mj6-jm8m CVE-2026-5078 MODERATE 20 days ago

### Impact Morgan's `:remote-user` token extracts the Basic auth username from the `Authorization` header and writes it to the log stream without ...

npm

7

Dependabot PRs

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

GHSA-pjhx-3c3w-9v23 CVE-2026-49858 MODERATE 20 days ago

### Impact `#[ApiProperty(security: ...)]` is evaluated per request to decide whether a property is exposed. The `componentsCache` arrays in `ApiP...

packagist

No PRs yet

Cookie attribute injection in Plug.Conn.Cookies.encode/2

EEF-CVE-2026-56813 GHSA-wpmj-jh88-rpgm CVE-2026-56813 LOW 20 days ago

## Summary Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTT...

hex

No PRs yet

Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

EEF-CVE-2026-56814 GHSA-95qv-c9g9-rm63 CVE-2026-56814 MEDIUM 20 days ago

## Summary Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length...

hex

No PRs yet

SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

EEF-CVE-2026-58225 GHSA-4mw9-4qgj-m97w CVE-2026-58225 LOW 20 days ago

## Summary SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL into the r...

hex

No PRs yet

Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values

GHSA-28jh-g32x-v9v4 CVE-2026-48598 LOW 21 days ago

### Summary `Tesla.Multipart.part_headers_for_disposition/1` interpolates `Content-Disposition` parameter values (field name, filename, and other ...

hex

No PRs yet

Tesla vulnerable to atom exhaustion via untrusted URL scheme

GHSA-h74c-q9j7-mpcm CVE-2026-48597 HIGH 21 days ago

### Summary In the Mint adapter for the Tesla HTTP client library, `Tesla.Adapter.Mint.open_conn/2` passes the URL scheme of every outgoing reques...

hex

No PRs yet

Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering

GHSA-9m9w-gxf7-rh8m CVE-2026-48595 HIGH 21 days ago

### Summary `Tesla.Middleware.FollowRedirects` is meant to strip the `Authorization` header when following a cross-origin redirect, but performs t...

hex

No PRs yet

Tesla has decompression bomb on response body

GHSA-mc85-72gr-vm9f CVE-2026-48594 HIGH 21 days ago

### Summary Any Tesla client pipeline that includes `Tesla.Middleware.DecompressResponse` or `Tesla.Middleware.Compression` eagerly decompresses H...

hex

No PRs yet

Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`

GHSA-q7jx-v53g-848w CVE-2026-48596 LOW 21 days ago

### Summary `Tesla.Multipart.add_content_type_param/2` appends caller-supplied strings to the multipart `Content-Type` header with no validation. ...

hex

No PRs yet

Mistune: Potential DoS via quadratic-time parsing in parse_link_text

GHSA-qcq2-496w-v96p CVE-2026-49851 HIGH 21 days ago

### Summary Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. A relatively small ...

pypi

No PRs yet

GoBGP confederation validation panics on empty AS_PATH attribute

GHSA-frrj-87jh-2772 CVE-2026-49838 MODERATE 21 days ago

Found through variant analysis based on `CVE-2026-41643` ## Summary GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics wh...

go

No PRs yet

GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

GHSA-gjrg-jjr3-56cm CVE-2026-49837 MODERATE 21 days ago

### Summary GoBGP contains a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remainin...

go

No PRs yet

psd-tools vulnerable to arbitrary file write via smart-object filename

GHSA-2rmg-vrx8-9j2f CVE-2026-49836 MODERATE 21 days ago

# psd-tools: arbitrary file write/read via smart-object path traversal ## Summary In `psd-tools` (all releases exposing the `SmartObject` API thr...

pypi

No PRs yet

sigstore-go has a multi-log threshold bypass via single compromised log

GHSA-9vcr-p3rj-q5q6 CVE-2026-49834 MODERATE 21 days ago

### Impact _What kind of vulnerability is it? Who is impacted?_ A verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimest...

go

No PRs yet

Rattler vulnerable to package cache path traversal via conda package build string

GHSA-h672-p7h7-97v9 CVE-2026-53956 MODERATE 21 days ago

`rattler_cache` and `py-rattler` were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache ...

cargo pypi

No PRs yet

OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect

GHSA-h5g6-xmh4-hc37 CVE-2026-55252 MODERATE 21 days ago

### Summary The restrictions on redirect URLs in `openrun` can be bypassed by attackers, leading to open redirect attacks. ### Details In the cur...

go

No PRs yet

mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

GHSA-g586-ccqf-7x4r CVE-2026-48862 HIGH 21 days ago

### Summary Mint's HTTP/2 client accepts `PUSH_PROMISE` frames from any server it connects to and inserts every promised stream into a per-connect...

hex

No PRs yet

mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)

GHSA-2p26-p43x-fhp8 CVE-2026-49754 HIGH 21 days ago

### Summary Mint's HTTP/2 client accumulates `CONTINUATION` header-block fragments into a per-connection buffer with no cap on size or frame count...

hex

No PRs yet

mint: Content-Length header accepts non-RFC "+" sign prefix

GHSA-mjqx-c6f6-7rc2 CVE-2026-49753 MODERATE 21 days ago

### Summary Mint's HTTP/1 client accepts `Content-Length` header values with a leading `+` sign (e.g. `+0`, `+123`), which RFC 7230 forbids (`Cont...

hex

No PRs yet

mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`

GHSA-2pg6-44cx-c49v CVE-2026-48861 LOW 21 days ago

### Summary Mint's HTTP/1 request encoder splices the caller-supplied `method` and `target` directly into the request line without character valid...

hex

No PRs yet

pypdf: Possible infinite loop when processing threads/articles in writer

GHSA-g9xf-7f8q-9mcj CVE-2026-54651 MODERATE 21 days ago

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/arti...

pypi

No PRs yet

Sylius: IDOR on Shop Payment Request API endpoints

GHSA-mr9r-h354-966r CVE-2026-53639 MODERATE 21 days ago

### Impact The `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints look up the payment request sole...

packagist

No PRs yet

Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

GHSA-6955-hrm5-c4qp CVE-2026-53638 MODERATE 21 days ago

### Impact An authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paym...

packagist

No PRs yet

Sylius: Cart FormComponent allows modification or deletion of an already-completed order

GHSA-5597-7rmh-97q5 CVE-2026-53637 MODERATE 21 days ago

### Impact A user opens the cart page in the browser. In the background, the order gets completed, e.g. an admin changes the status, or the user fi...

packagist

No PRs yet

YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service

GHSA-px5m-h76g-p7p8 CVE-2026-52778 CRITICAL 21 days ago

### Summary An unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sa...

packagist

No PRs yet

YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize

GHSA-9369-69wj-7m2f CVE-2026-52777 CRITICAL 21 days ago

## Details ### Sink `tools/bazar/services/CSVManager.php` line 372-399: ``` public function importEntry(array $importedEntries, string $formId):...

packagist

No PRs yet

YesWiki has Authenticated SQL Injection via ReactionManager

GHSA-4pf7-cc4r-g63h CVE-2026-52775 HIGH 21 days ago

## Summary YesWiki through the latest development branch contains a SQL injection vulnerability in `ReactionManager::deleteUserReaction()` that al...

packagist

No PRs yet

YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes

GHSA-r5xw-gcgw-hwp5 CVE-2026-52774 MODERATE 21 days ago

### Summary YesWiki's Bazar widget handler reflects the `id` `GET` parameter into HTML attributes using `strip_tags()` only. Because `strip_tags()`...

packagist

No PRs yet

YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`

GHSA-35f3-pg38-486f CVE-2026-52773 MODERATE 21 days ago

### Summary YesWiki's archived-revision view reflects the `time` `GET` parameter into a hidden HTML input in `handlers/page/show.php` without escap...

packagist

No PRs yet

YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))

GHSA-xc7j-3g8q-9vh4 CVE-2026-52772 MODERATE 21 days ago

# Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form r...

packagist

No PRs yet

YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

GHSA-8f2v-2qhj-gfwg CVE-2026-52771 HIGH 21 days ago

## Summary `ApiController::deletePage()` interpolates a page tag retrieved from the database into a `DELETE FROM …_links WHERE to_tag = '$tag'` que...

packagist

No PRs yet

YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters

GHSA-qg78-vmvc-fhjw CVE-2026-52770 HIGH 21 days ago

### Summary YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric `query` / `queries` filters. For ...

packagist

No PRs yet

YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

GHSA-vw42-752g-5mrp CVE-2026-52769 HIGH 21 days ago

## Summary The `POST /api/forms/{formId}/actor/inbox` route - exposed publicly with `acl:"public"` - accepts an HTTP `Signature` header whose `keyI...

packagist

No PRs yet

YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`

GHSA-mv28-wj57-f57g CVE-2026-52767 HIGH 21 days ago

## Summary `HttpSignatureService::verifySignature()` checks the result of PHP's `openssl_verify()` with a **loose boolean negation** - `if (!openss...

packagist

No PRs yet