Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

GHSA-gx55-f84r-v3r7 CVE-2026-50564 CRITICAL about 1 month ago

### Summary Fission's `Environment` CRD exposes `spec.runtime.podSpec` and `spec.builder.podSpec`, which are merged into the Kubernetes pod specs ...

go

No PRs yet

Fission Container Executor Function PodSpec Injection Leading to Node Escape

GHSA-v455-mv2v-5g92 CVE-2026-50563 CRITICAL about 1 month ago

### Summary Fission's Container Executor path lets a tenant supply `Function.spec.podspec` directly; the executor merges it into the executor-buil...

go

No PRs yet

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

GHSA-wmgg-3p4h-48x7 CVE-2026-50545 CRITICAL about 1 month ago

### Summary A stronger framing of the same root cause as GHSA-gx55-f84r-v3r7: the `Environment.spec.runtime.podSpec` / `spec.builder.podSpec` pass...

go

No PRs yet

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

GHSA-cvw6-gfvv-953q CVE-2026-49824 HIGH about 1 month ago

### Summary The Fission Function admission webhook (`pkg/webhook/function.go`) validated that `spec.secrets[].namespace` and `spec.configmaps[].na...

go

No PRs yet

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

GHSA-3r8v-2xmj-5c39 CVE-2026-49823 HIGH about 1 month ago

### Summary A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the ...

go

No PRs yet

Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance

GHSA-gc3j-79f2-7vvw CVE-2026-49822 HIGH about 1 month ago

### Summary A low-privilege developer who could create a `KubernetesWatchTrigger` (KWT) in their own namespace was able to establish a persistent ...

go

No PRs yet

Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration

GHSA-vjhc-cf4p-72q4 CVE-2026-49821 HIGH about 1 month ago

### Summary Fission's `buildermgr` controller processed `Package` CRDs without verifying that `Package.spec.environment.namespace` matched `Packag...

go

No PRs yet

Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec

GHSA-7m8x-qg2j-4m3v HIGH about 1 month ago

### Summary The Fission MessageQueueTrigger (MQT) scaler controller exposed two privilege-escalation primitives to any subject able to create MQTs...

go

No PRs yet

Sigstore Java has a vulnerability with bundle verification of integratedTime

GHSA-qqw8-7c2r-jxch CVE-2026-48791 LOW about 1 month ago

### Summary Regression: Verification of `integratedTime` from Rekor V1 Log Entry against Fuclio Certificate validity was missing ### Details - PR ...

maven

No PRs yet

@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

GHSA-g4w6-vmgf-xqvx CVE-2026-49473 HIGH about 1 month ago

### Summary @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express appl...

npm

No PRs yet

Kahi has privilege-drop and socket/log permission issues

GHSA-55f6-4pr5-c7m5 HIGH about 1 month ago

Kahi releases up to and including v0.1.0-alpha.8 contain three privilege/permission issues, all fixed in v0.1.0-alpha.9. They were identified in a ...

go

No PRs yet

Paymenter has URL parameter injection that bypasses paid plan limits at checkout

GHSA-5q4q-834j-g8g4 CVE-2026-47198 HIGH about 1 month ago

### Summary The checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs int...

packagist

No PRs yet

RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API

GHSA-w6cq-9cf4-gqpg CVE-2023-46118 MODERATE about 1 month ago

### Summary Responsibly disclosed by @NSEcho. HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very...

hex

No PRs yet

RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins

GHSA-v9gv-xp36-jgj8 CVE-2022-31008 MODERATE about 1 month ago

### Impact Shovel and Federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seed...

hex

No PRs yet

Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

GHSA-v5pm-xwqc-g5wc CVE-2026-49451 HIGH about 1 month ago

### Impact A small OpenAPI document containing a circular schema reference can cause process termination through stack overflow in Microsoft.OpenA...

nuget

1

Dependabot PRs

Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, wh...

CPANSA-Net-BitTorrent-2026-57080 CVE-2026-57080 about 1 month ago

Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire fram...

cpan

No PRs yet

Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once per nested list or dictionary level with no depth cap, and each recursive call receives the remaining buffer by valu...

CPANSA-Net-BitTorrent-2026-57081 CVE-2026-57081 about 1 month ago

Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once per nested ...

cpan

No PRs yet

Net::BitTorrent versions through 2.0.1 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG. The MSE (Message Stream Encryption) handshake derives its 160-bit Diffie-Hellman private key from Perl's rand(), a non-cryptogra...

CPANSA-Net-BitTorrent-2026-57082 CVE-2026-57082 about 1 month ago

Net::BitTorrent versions through 2.0.1 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG. The MSE (Message Stream...

cpan

No PRs yet

DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subclass, sets bindtype in its constructor but never quote_char, so SQL::Abstract emits identifiers verbatim. C...

CPANSA-DBIx-QuickORM-2026-13766 CVE-2026-13766 about 1 month ago

DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subcla...

cpan

No PRs yet

Net::BitTorrent versions through 2.0.1 for Perl write files outside the download directory via path traversal in peer-supplied metadata. Net::BitTorrent validates file path components only on the .torrent-file ingest path. The peer and magnet metadata...

CPANSA-Net-BitTorrent-2026-57079 CVE-2026-57079 about 1 month ago

Net::BitTorrent versions through 2.0.1 for Perl write files outside the download directory via path traversal in peer-supplied metadata. Net::BitT...

cpan

No PRs yet

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

GHSA-q2m9-6jp9-c6mc CVE-2026-44840 HIGH about 1 month ago

## Summary The `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values a...

go

No PRs yet

Atom-table exhaustion denial-of-service via JSON parse_document in MDEx

EEF-CVE-2026-53426 GHSA-923r-7vf4-5vw8 CVE-2026-53426 HIGH about 1 month ago

## Summary Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.parse\_document...

hex

No PRs yet

Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)

EEF-CVE-2026-54889 GHSA-4383-7xfp-gpph CVE-2026-54889 MEDIUM about 1 month ago

## Summary Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scripting via unsan...

hex

No PRs yet

Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex

EEF-CVE-2026-54888 GHSA-3w4f-53g2-f66p CVE-2026-54888 MEDIUM about 1 month ago

## Summary Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of service via deeply nested Markdown input. mdex converts betwee...

hex

No PRs yet

Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service

EEF-CVE-2026-53429 GHSA-cmvp-gp9f-23xw CVE-2026-53429 MEDIUM about 1 month ago

## Summary Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mdex\_native allows an attacker who controls a r...

hex

No PRs yet

Unbounded memory allocation in highlight_lines range expansion in mdex

EEF-CVE-2026-53428 GHSA-j93q-9cvj-rxfm CVE-2026-53428 MEDIUM about 1 month ago

## Summary Memory Allocation with Excessive Size Value vulnerability in leandrocp mdex allows an unauthenticated attacker to cause a denial of ser...

hex

No PRs yet

Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute

EEF-CVE-2026-53427 GHSA-v664-pmxr-mxxx CVE-2026-53427 LOW about 1 month ago

## Summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or r...

hex

No PRs yet

OpenAM OAuth Authorization Bypass via PKCE Challenge

GHSA-4v2w-2wqp-mc85 CVE-2026-48717 MODERATE about 1 month ago

## Summary **Description** An Improper Authorization (CWE-285) issue in OpenAM's OAuth2 authorization-code grant allows a PKCE-protected authoriz...

maven

No PRs yet

OpenAM OAuth Client Impersonation via JWKS Resolver Cache

GHSA-f2cx-463q-7m2c CVE-2026-47426 HIGH about 1 month ago

## Summary **Description** An Improper Authentication (CWE-287) issue in OpenAM's OAuth2 private_key_jwt client authentication path allows any re...

maven

No PRs yet

OpenAM Authenticated RCE via Groovy Sandbox Escape

GHSA-69j4-qvqr-hpw3 CVE-2026-47424 HIGH about 1 month ago

## Summary **Description** A Protection Mechanism Failure (CWE-693) in OpenAM's server-side scripting sandbox allows an authenticated script auth...

maven

No PRs yet

CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. The minify function has a memory leak when processing a document containing only characters to be removed, such as comments and whitespace.

CPANSA-CSS-Minifier-XS-2026-13593 CVE-2026-13593 about 1 month ago

CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. The minify function has a memory lea...

cpan

No PRs yet

JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp versus division disambiguator in JsTokenizeString (XS.xs) inspects the previous token's la...

CPANSA-JavaScript-Minifier-XS-2026-56017 CVE-2026-56017 about 1 month ago

JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slas...

cpan

No PRs yet

CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path. The decrypt_done($tag) form compares it against the computed tag with memNE (memcmp() != 0), which short-circuits on th...

CPANSA-CryptX-2026-13758 CVE-2026-13758 about 1 month ago

CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path. The decrypt_do...

cpan

No PRs yet

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsS...

CPANSA-JavaScript-Minifier-XS-2026-56018 CVE-2026-56018 about 1 month ago

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs...

cpan

No PRs yet

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

GHSA-qrv3-253h-g69c HIGH about 1 month ago

## Summary `pnpm` accepts package names from the env lockfile `configDependencies` section and uses those names directly when creating config depe...

npm

2

Dependabot PRs

pnpm: `patch-remove` could delete project-selected files outside the patches directory

GHSA-72r4-9c5j-mj57 HIGH about 1 month ago

## Summary The `patch-remove` deletion-scope issue tracked as GHSA-72r4-9c5j-mj57 / CAND-PNPM-030 has been addressed in pnpm. A crafted patch ent...

npm

No PRs yet

pnpm: Hoisted install imports lockfile alias outside node_modules

GHSA-fr4h-3cph-29xv HIGH about 1 month ago

## Summary The hoisted dependency alias issue tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059 has been addressed in both pnpm and pacquet. A craft...

npm

2

Dependabot PRs

Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API

GHSA-ww5p-j6cj-6mqq MODERATE about 1 month ago

### Summary The `GET /api/v1/ddns` and `GET /api/v1/notification` endpoints return full resource objects including plaintext third-party API crede...

go

No PRs yet

pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

GHSA-v23m-ccfg-pq9h CVE-2026-55700 HIGH about 1 month ago

## Summary The staged-tarball filename traversal reported as GHSA-v23m-ccfg-pq9h / CAND-PNPM-038 is fixed on `main` by [pnpm/pnpm#12303](https://g...

npm

No PRs yet

pnpm: Reserved bin name deletes PNPM_HOME during global remove

GHSA-4gxm-v5v7-fqc4 CVE-2026-55699 MODERATE about 1 month ago

<details> <summary>Maintainer Action Plan</summary> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start ...

npm

No PRs yet

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

GHSA-w466-c33r-3gjp CVE-2026-55698 HIGH about 1 month ago

<!-- maintainer-action:start --> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the ...

npm

No PRs yet

Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

GHSA-hmgp-w9jm-vp95 CVE-2026-49338 HIGH about 1 month ago

## Summary In gonic, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. On...

go

No PRs yet

gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists

GHSA-2fp4-5v5c-4448 CVE-2026-49339 HIGH about 1 month ago

## Summary The maintainer's recent fix in [`6dd71e6a3c966867ef8c900d359a7df75789f410`](https://github.com/sentriz/gonic/commit/6dd71e6) (`fix(subs...

go

No PRs yet

gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host

GHSA-4gxv-p5g5-j7w7 CVE-2026-49340 HIGH about 1 month ago

## Summary A logic error in `ServeCreateOrUpdatePlaylist` allows **any authenticated Subsonic user** (including non-admin) to write playlist M3U c...

go

No PRs yet

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

GHSA-gj8w-mvpf-x27x CVE-2026-55697 HIGH about 1 month ago

<!-- maintainer-action:start --> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the ...

npm

No PRs yet

pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

GHSA-5wx6-mg75-v57r CVE-2026-55487 HIGH about 1 month ago

## Summary Keep build approval for opaque dependency sources byte-exact for GHSA-5wx6-mg75-v57r / CAND-PNPM-123. Merged upstream commit `bf1b731e...

npm

No PRs yet

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

GHSA-3qhv-2rgh-x77r CVE-2026-55180 MODERATE about 1 month ago

<!-- maintainer-action:start --> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the ...

npm

No PRs yet

ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

GHSA-44cp-c3ww-9rv5 CVE-2026-53465 MODERATE about 1 month ago

An crafted multi-frame can result in a heap buffer over-write when encoding it with the SF3 encoder.

nuget

No PRs yet

ImageMagick: Memory Leak in wand option parser when providing invalid arguments

GHSA-j989-f892-2335 CVE-2026-53464 MODERATE about 1 month ago

When providing invalid options to the wand option parser a small memory leak will occur.

nuget

No PRs yet

Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors

GHSA-7mqq-4v55-88gh CVE-2026-54244 LOW about 1 month ago

### Impact The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and renders caller-supplied fi...

packagist

No PRs yet