YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes

GHSA-r5xw-gcgw-hwp5 CVE-2026-52774 MODERATE 21 days ago

### Summary YesWiki's Bazar widget handler reflects the `id` `GET` parameter into HTML attributes using `strip_tags()` only. Because `strip_tags()`...

packagist

No PRs yet

YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`

GHSA-35f3-pg38-486f CVE-2026-52773 MODERATE 21 days ago

### Summary YesWiki's archived-revision view reflects the `time` `GET` parameter into a hidden HTML input in `handlers/page/show.php` without escap...

packagist

No PRs yet

YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))

GHSA-xc7j-3g8q-9vh4 CVE-2026-52772 MODERATE 21 days ago

# Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form r...

packagist

No PRs yet

YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

GHSA-8f2v-2qhj-gfwg CVE-2026-52771 HIGH 21 days ago

## Summary `ApiController::deletePage()` interpolates a page tag retrieved from the database into a `DELETE FROM …_links WHERE to_tag = '$tag'` que...

packagist

No PRs yet

YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters

GHSA-qg78-vmvc-fhjw CVE-2026-52770 HIGH 21 days ago

### Summary YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric `query` / `queries` filters. For ...

packagist

No PRs yet

YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

GHSA-vw42-752g-5mrp CVE-2026-52769 HIGH 21 days ago

## Summary The `POST /api/forms/{formId}/actor/inbox` route - exposed publicly with `acl:"public"` - accepts an HTTP `Signature` header whose `keyI...

packagist

No PRs yet

YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`

GHSA-mv28-wj57-f57g CVE-2026-52767 HIGH 21 days ago

## Summary `HttpSignatureService::verifySignature()` checks the result of PHP's `openssl_verify()` with a **loose boolean negation** - `if (!openss...

packagist

No PRs yet

YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

GHSA-6x7x-gcmf-7r8x CVE-2026-52766 CRITICAL 21 days ago

### Summary The `{{erasespamedcomments}}` wiki action (`actions/EraseSpamedCommentsAction.php`) accepts a `suppr[]` array from `POST` and deletes ...

packagist

No PRs yet

YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read

GHSA-89v6-j5x6-cmj3 CVE-2026-52763 MODERATE 21 days ago

### Summary The `recentchanges` action (`actions/recentchanges.php`) accepts a `period` argument from two disjoint parameter spaces: the URL query...

packagist

No PRs yet

YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

GHSA-65p8-9433-jpcp CVE-2026-52762 HIGH 21 days ago

### Summary YesWiki Bazar contains a stored Server-Side Template Injection (`SSTI`) vulnerability in the semantic template feature that can be esca...

packagist

No PRs yet

Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

GHSA-pqpw-cvm4-8mv9 CVE-2026-53769 MODERATE 21 days ago

### Summary Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy m...

rubygems

No PRs yet

laravel-backup-restore has an OS Command Injection during database restore

GHSA-w9mx-xmg4-gc4r CVE-2026-53932 HIGH 21 days ago

## Summary A crafted backup archive can trigger OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerat...

packagist

No PRs yet

nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate

GHSA-339v-266x-79xr CVE-2026-53602 MODERATE 21 days ago

## Summary Two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgm...

go

No PRs yet

Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data

GHSA-382c-vx95-w3p5 MODERATE 22 days ago

### Summary `GET /v1/contributors/:login/profile` and the `gittensory_get_contributor_profile` MCP tool skip the contributor-scoped access check ...

npm

No PRs yet

Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

GHSA-hm42-q32m-vj4f CVE-2026-53760 MODERATE 22 days ago

## Summary The `modules/plugins.php` endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF tok...

packagist

No PRs yet

Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

GHSA-86vw-x4ww-x467 HIGH 22 days ago

The `actionRenderCardPreview()` method in `FieldsController` passes the `fieldLayoutConfig` POST parameter directly to `Fields::createLayout()` wit...

packagist

No PRs yet

Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

GHSA-c43v-4cr8-6mvp LOW 22 days ago

### Summary An authenticated path traversal in `assets/icon` allows local SVG file read by passing traversal sequences in the `extension` paramete...

packagist

No PRs yet

Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`

GHSA-9pmc-p236-855h CVE-2026-53727 HIGH 22 days ago

## Summary `CssParser::Parser#read_remote_file` (and therefore `load_uri!`, and the `@import`-following branch of `add_block!`) issues HTTP/HTTPS ...

rubygems

No PRs yet

org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

GHSA-7cmj-v6x8-frvv CVE-2026-49485 HIGH 22 days ago

# Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility inten...

maven

No PRs yet

pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small

GHSA-8f95-v3jq-cj86 CVE-2026-53720 MODERATE 22 days ago

### Impact The argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on th...

pypi

No PRs yet

Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

GHSA-rqrh-8wpv-x7hh CVE-2026-50553 HIGH 22 days ago

## Summary Note Mark validates book and note `slug` values with the OpenAPI/huma tag `pattern:"[a-z0-9-]+"`. huma compiles this with `regexp.MustC...

go

No PRs yet

Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books

GHSA-588f-fvcv-xhvf CVE-2026-50554 MODERATE 22 days ago

Summary GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true...

go

No PRs yet

Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

GHSA-836r-79rf-4m37 CVE-2026-49477 HIGH 22 days ago

### Summary The CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) contains a regular expression vulnerable to catast...

pypi

No PRs yet

Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

GHSA-2wc2-fm75-p42x CVE-2026-49476 HIGH 22 days ago

### Summary The CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) allocates unbounded memory when compiling large co...

pypi

No PRs yet

Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths

GHSA-52vm-mxx8-f227 HIGH 22 days ago

### Impact In Phantom <= 1.3.0, when `PHANTOM_OUTPUT_DIR` was unset (the default), the MCP tools accepted arbitrary absolute output paths with no ...

pypi

No PRs yet

Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers

GHSA-q6gh-6v2r-hjv3 MODERATE 22 days ago

### Impact > DefaultHttpClient follows redirects and forwards Authorization, Cookie, and Proxy-Authorization headers to redirect targets across do...

maven

No PRs yet

Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS

GHSA-387m-935m-c4vw HIGH 22 days ago

The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead ...

maven

No PRs yet

pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

GHSA-c2f9-4mc8-j656 CVE-2026-48987 MODERATE 22 days ago

## Description: The `EventManager` module in `pyload` manages a list of `Client` instances for subscribing to events. The addition of each unique `...

pypi

No PRs yet

pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

GHSA-m5x5-28jr-gpjj CVE-2026-48737 MODERATE 22 days ago

## Summary `is_global_address` in [`src/pyload/core/utils/web/check.py`](https://github.com/pyload/pyload/blob/1b12dc7f348db8c144e0f39215680415e90...

pypi

No PRs yet

Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

GHSA-37h2-6p4f-mp3q CVE-2026-49471 HIGH 22 days ago

### Summary Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port (TCP 24282, hardcoded as `0x5EDA` in...

pypi

No PRs yet

NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

GHSA-6h3c-r723-7fx3 CVE-2026-49464 HIGH 22 days ago

## Impact In versions from 1.5.0 up to and including 3.0.0, any authenticated portal user could complete and tamper with another user's open task ...

maven

No PRs yet

NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

GHSA-qpm9-h556-mwxm CVE-2026-49463 MODERATE 22 days ago

## Impact In versions up to and including 3.0.0, two parts of the GraphQL API returned data without checking whether the data belonged to the logg...

maven

No PRs yet

Waku has an Open Redirect via `unstable_redirect` Helper

GHSA-43fc-v873-qw85 CVE-2026-49456 LOW 22 days ago

## Summary The `unstable_redirect()` helper exported from `waku/router/server` (`packages/waku/src/router/define-router.tsx:156–161`) accepts an a...

npm

No PRs yet

Waku: Cross-Origin CSRF on RSC Server Action Dispatch

GHSA-75w3-gmqx-993q CVE-2026-49455 MODERATE 22 days ago

## Summary Waku's RSC request dispatcher invokes server actions without validating the request's `Origin` (or `Sec-Fetch-Site`) header. A cross-or...

npm

No PRs yet

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

GHSA-xqhv-chqm-fhcc CVE-2026-53649 CRITICAL 22 days ago

# Unauthenticated Cross-Origin Plugin Upload Leads to RCE (Joro ≤ v1.1.0) **Severity:** Critical **CVSS v3.1:** 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I...

go

No PRs yet

OneRingBuf has a Use After Free Vulnerability

GHSA-q95x-7g78-rccv MODERATE 22 days ago

Affected versions of `oneringbuf` exposed the obsolete `IntoRef::into_ref` method through the public `IntoRef` trait. For heap-backed ring buffers,...

cargo

No PRs yet

DSpace: Path Traversal is possible through LDN message generation

GHSA-9qm4-rh6w-pq5x CVE-2026-49833 MODERATE 22 days ago

## Overview A path traversal vulnerability is possible via the [COAR Notify / LDN](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379126679/COAR+No...

maven

No PRs yet

DSpace: ORE resource URI does not validate scheme for non-web resources

GHSA-c827-pw3m-67w7 CVE-2026-49830 MODERATE 22 days ago

## Overview When ingesting an aggregated ORE resource by URI (using the [OAI-ORE Harvester](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/37912590...

maven

No PRs yet

DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output path

GHSA-v66x-68f2-pxf5 CVE-2026-49831 MODERATE 22 days ago

## Overview The [Curation Task](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379126845/Curation+Tasks) feature allows an output path to be used b...

maven

No PRs yet

DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN

GHSA-9x82-rm84-c6x7 CVE-2026-49832 HIGH 22 days ago

## Overview Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for [COAR Notify/LDN messages](https://wiki.lyrasis.org/...

maven

No PRs yet

Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler

GHSA-mxwc-wh95-pw4g MODERATE 22 days ago

## Summary `trapster.libs.dns.decode_labels()` decodes DNS names from attacker-supplied UDP packets and recurses **once per RFC 1035 compression p...

pypi

No PRs yet

Sharp Missing Authorization Check in Quick Creation Command Endpoints

GHSA-vmwx-m75v-qvch CVE-2026-53634 MODERATE 22 days ago

### Impact The create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp use...

packagist

No PRs yet

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

GHSA-v5px-423j-pf7p CVE-2026-52831 CRITICAL 22 days ago

## Summary Nuclio controller builds a `curl` invocation string for each cron trigger and stores it as the `args` of a Kubernetes CronJob container...

go

No PRs yet

async-tar PAX extension-header desync enables tar entry/content smuggling

GHSA-35rm-7j9c-2f7m CVE-2026-53600 MODERATE 22 days ago

## Summary `async-tar` v0.6.0 mis-applies a buffered PAX `size` extension to an intermediary extension header (a GNU longname `L`, a GNU longlink ...

cargo

No PRs yet

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests

GHSA-659f-rgp5-w4wf CVE-2026-50197 HIGH 22 days ago

### Summary `zalando/skipper`'s OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 `Transfer-Encoding: chunked` and...

go

No PRs yet

`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

GHSA-4jhm-jv67-739f CVE-2026-49825 HIGH 22 days ago

# `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`) **Reporter:** Guillem Lefait <guillem@...

pypi

No PRs yet

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the add...

CPANSA-Imager-2026-14454 CVE-2026-14454 23 days ago

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treatin...

cpan

No PRs yet

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in ...

CPANSA-ack-2026-49145 CVE-2026-49145 23 days ago

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from ...

cpan

No PRs yet

App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context o...

CPANSA-ack-2026-49146 CVE-2026-49146 23 days ago

App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory...

cpan

No PRs yet

App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach th...

CPANSA-ack-2026-49147 CVE-2026-49147 23 days ago

App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a fi...

cpan

No PRs yet