Weblate SSRF: outbound URL guard misses some private ranges

GHSA-vmfc-9982-2m45 CVE-2026-50127 MODERATE 23 days ago

### Impact Weblate's `VCS_RESTRICT_PRIVATE` did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private ...

pypi

No PRs yet

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

GHSA-2jcc-mxv7-p3f9 CVE-2026-53508 MODERATE 23 days ago

## Summary From **v1.13.2** through **v1.18.0**, oasdiff did not enforce `--allow-external-refs=false` (library: `openapi3.Loader.IsExternalRefsAl...

go

No PRs yet

KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping

GHSA-6w3m-4hhp-775q CVE-2026-53572 MODERATE 23 days ago

### Summary `pkg/scalers/postgresql_scaler.go` builds libpq-style connection strings by concatenating `key=value` pairs separated by spaces. Each t...

go

No PRs yet

Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion

GHSA-f66q-9rf6-8795 MODERATE 23 days ago

### Summary Flask-Security-Too 5.8.0 and 5.8.1 mark a session as reauthentication-fresh after processing a WebAuthn assertion whose proven credent...

pypi

No PRs yet

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

GHSA-4g5x-hcwm-82jw CVE-2026-53553 HIGH 23 days ago

> [ Click here to jump to the Simplified Chinese version (点击跳转到简体中文版本)](#goploy-系统任意文件读取) # Goploy System Arbitrary File Read Vulnerability ## Bas...

go

No PRs yet

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

GHSA-26rh-24rg-j3vv CVE-2026-53552 CRITICAL 23 days ago

### Summary `Project.AddFile`, `Project.EditFile`, `Project.RemoveFile`, and `Project.Edit` in `cmd/server/api/project/handler.go` accept a projec...

go

No PRs yet

ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path

GHSA-q855-8rh5-jfgq MODERATE 23 days ago

### Summary In add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path **and** at the bare root of the published por...

pypi

No PRs yet

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

GHSA-cwv4-h3j5-w3cf LOW 23 days ago

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3 ## Summary `plabayo/rama` contains a stored/reflected c...

cargo

No PRs yet

aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address

GHSA-v3q9-hj7j-63hq CVE-2026-53533 MODERATE 23 days ago

### Summary `aiosmtplib`'s `SMTP.mail()`, `SMTP.rcpt()`, `SMTP.vrfy()` and `SMTP.expn()` send the caller-supplied email address to the server with...

pypi

No PRs yet

Kite has an authenticated cluster RBAC bypass in /api/v1/overview

GHSA-gvhc-wv3v-7pf8 CVE-2026-53487 MODERATE 23 days ago

## Summary Authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cl...

go

No PRs yet

Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

GHSA-gq4g-fpc9-vjfq LOW 23 days ago

## Impact `Webauthn\SimpleFakeCredentialGenerator` is the library-provided default implementation of the `FakeCredentialGenerator` interface. It r...

packagist

No PRs yet

ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)

GHSA-4w5h-hx6r-28q7 CVE-2026-53531 MODERATE 23 days ago

### Summary RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, wi...

cargo

No PRs yet

ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

GHSA-4hgp-59h5-gvrj CVE-2026-53530 HIGH 23 days ago

### Summary The public parser entrypoint `ratex_parser::parse(&str)` panics on the **9-byte** input `\verbéxé` (i.e. `\verb` followed by the non-A...

cargo

No PRs yet

@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers

GHSA-j8v8-g9cx-5qf4 HIGH 24 days ago

### Am I affected? Users are affected if all of these hold: - They install and register the `@better-auth/scim` plugin (`plugins: [scim()]`). - T...

npm

No PRs yet

Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows

GHSA-2vg6-77g8-24mp LOW 24 days ago

### Am I affected? Users are affected if all of the following are true: - They configure `secondaryStorage` on `betterAuth(...)` (Redis, KV, or a...

npm

No PRs yet

@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive

GHSA-7w99-5wm4-3g79 CVE-2026-53518 HIGH 24 days ago

### Am I affected? Users are affected if all of the following are true: - Their project depends on `@better-auth/oauth-provider` at a version `>=...

npm

No PRs yet

@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints

GHSA-5rr4-8452-hf4v CVE-2026-53513 CRITICAL 24 days ago

### Am I affected? Users are affected if all of the following are true: - Their application uses `@better-auth/sso` at a version `>= 0.1.0, < 1.6...

npm

No PRs yet

Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

GHSA-392p-2q2v-4372 CVE-2026-53517 HIGH 24 days ago

### Am I affected? Users are affected if all of the following are true: - Their project depends on `@better-auth/oauth-provider` at a version `>=...

npm

No PRs yet

Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

GHSA-9h47-pqcx-hjr4 HIGH 24 days ago

### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` at a version below the patched rel...

npm

No PRs yet

Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

GHSA-86j7-9j95-vpqj HIGH 24 days ago

### Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enables the `oidc-provider` plu...

npm

No PRs yet

Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email

GHSA-g38m-r43w-p2q7 CVE-2026-53516 HIGH 24 days ago

### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` at a version `< 1.6.11` on the sta...

npm

No PRs yet

Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

GHSA-fmh4-wcc4-5jm3 CVE-2026-53514 HIGH 24 days ago

### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` with the `organization` plugin (`i...

npm

No PRs yet

@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators

GHSA-p2fr-6hmx-4528 MODERATE 24 days ago

### Am I affected? Users are affected if all of the following hold: - Their application depends on `@better-auth/oauth-provider` on any stable `...

npm

No PRs yet

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

GHSA-pw9m-5jxm-xr6h CVE-2026-53512 CRITICAL 24 days ago

### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` and has enabled at least one of: `...

npm

No PRs yet

netfoil: Attacker controlled data written to logs

GHSA-7856-g3gv-9wq8 LOW 24 days ago

### Summary Domain names were written to the log without first being validated to contain allowed characters. ### Impact Depends on how the logs w...

go

No PRs yet

netfoil has a resource leak in LRU cache

GHSA-3g4q-2f67-2gvh LOW 24 days ago

### Summary When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up. ### Impact A local attacke...

go

No PRs yet

netfoil has a domain name filter bypass via multiple questions

GHSA-59qp-cfj3-rp64 MODERATE 24 days ago

### Summary Potential bypass of domain name filter by crafting a DNS request with multiple questions, with the first question being legitimate. ##...

go

No PRs yet

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

GHSA-fqf6-gxhh-2xhw HIGH 24 days ago

`determine_backup_mode` in `src/uucore/src/lib/features/backup_control.rs` only checks `--backup`/`-b` and returns `BackupMode::None` when only `--...

cargo

No PRs yet

@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

GHSA-g84h-j7jj-x32p CVE-2026-53509 MODERATE 24 days ago

### Summary A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter ha...

npm

No PRs yet

Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

GHSA-jgx9-jr5x-mvpv CVE-2026-34225 MODERATE 24 days ago

### Summary There is a blind server side request forgery in the functionality that allows editing an image via a prompt. The affected function will...

pypi

No PRs yet

Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

GHSA-vjm7-m4xh-7wrc CVE-2026-26193 HIGH 24 days ago

### Summary Manually modifying chat history allows setting the `embeds` property on a response message, the content of which is loaded into an iFra...

pypi

No PRs yet

Open WebUI vulnerable to Stored XSS via iFrame in citations model

GHSA-xc8p-9rr6-97r2 CVE-2026-26192 HIGH 24 days ago

### Summary Manually modifying chat history allows setting the `html` property within document metadata. This causes the frontend to enter a code p...

pypi

No PRs yet

Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions

GHSA-9f4f-jv96-8766 CVE-2025-46719 HIGH 24 days ago

### Summary A vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaScript code into a chat tran...

pypi

No PRs yet

Open WebUI allows limited stored XSS vila uploaded html file

GHSA-8gh5-qqh8-hq3x CVE-2025-46571 MODERATE 24 days ago

### Summary Low privileged users can upload HTML files which contain JavaScript code via the `/api/v1/files/` backend endpoint. This endpoint retur...

pypi

No PRs yet

Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff

EEF-CVE-2026-56812 GHSA-63mc-hw7g-86rr CVE-2026-56812 MEDIUM 24 days ago

## Summary Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an a...

hex npm

No PRs yet

Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service

EEF-CVE-2026-56811 GHSA-6983-jfq8-485w CVE-2026-56811 HIGH 24 days ago

## Summary Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauth...

hex

No PRs yet

EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose

GHSA-c8m7-r2jv-rw63 CVE-2026-45016 MODERATE 24 days ago

### Summary The function processes image URLs embedded in an HTML email body without validating or restricting URI schemes. The check `!str_starts_...

packagist

No PRs yet

ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

GHSA-hwpq-hmq9-wj77 CVE-2026-44512 MODERATE 24 days ago

### Summary Null pointer dereference (SIGSEGV) in `Upsample_6_7::adapt_upsample_6_7()` (`onnx/version_converter/adapters/upsample_6_7.h:31`) when ...

pypi

No PRs yet

New API is vulnerable to CSRF through user email binding

GHSA-26v7-h57m-gh9m CVE-2026-44342 MODERATE 24 days ago

## Summary The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session co...

go

No PRs yet

EGroupware has Authenticated RCE via Malicious eTemplate Upload

GHSA-8737-2x9g-xjj7 CVE-2026-40187 HIGH 24 days ago

## Summary An authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to...

packagist

No PRs yet

XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+

GHSA-qj4x-9g63-25g6 CVE-2026-34151 HIGH 24 days ago

### Impact With Jetty 12+ a user can craft a URL to access any resource the Jetty instance is allowed to access. For example `http://[host]/xwiki...

maven

No PRs yet

New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs

GHSA-6qcr-qxgr-m7fv CVE-2026-33655 HIGH 24 days ago

## Summary The default SSRF protection configuration did not apply IP filtering to hostnames. With `ApplyIPFilterForDomain` disabled by default, U...

go

No PRs yet

EGroupware has a Remote Code Execution Vulnerability

GHSA-h9qx-v5xp-ph8p CVE-2026-27823 CRITICAL 24 days ago

## Summary A critical vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticat...

packagist

No PRs yet

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed t...

CPANSA-Module-Load-2011-10043 CVE-2011-10043 24 days ago

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed t...

cpan

No PRs yet

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normali...

CPANSA-DBI-2026-14740 CVE-2026-14740 24 days ago

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQ...

cpan

No PRs yet

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.6...

CPANSA-DBI-2026-14739 CVE-2026-14739 24 days ago

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-202...

cpan

No PRs yet

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a st...

CPANSA-DBI-2026-14380 CVE-2026-14380 24 days ago

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Pro...

cpan

No PRs yet

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s*$//u. Because \s* matches greedily and the $ anchor fails whenever a non-whitespa...

CPANSA-String-Util-2026-14895 CVE-2026-14895 24 days ago

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped traili...

cpan

No PRs yet

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `heade...

CPANSA-HTTP-Tiny-2026-7017 CVE-2026-7017 24 days ago

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_m...

cpan

No PRs yet

cut: -s ignored in -z -d '' newline-delimiter mode

GHSA-pmfc-4wjj-gmhx CVE-2026-35381 LOW 25 days ago

`cut` routes `-z -d ''` through a special newline-delimiter path that ignores the `-s` only-delimited flag, emitting whole undelimited records (plu...

cargo

No PRs yet