Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

GHSA-9rc6-8cjv-rcvx CVE-2026-53523 MODERATE about 1 month ago

## 1. Description The `getRedirectURL` function in `oauth2.go:22-29` constructs the OAuth2 callback URL by concatenating the request's `Host` head...

go

No PRs yet

Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS

GHSA-jg62-j5h6-8mpq CVE-2026-53522 MODERATE about 1 month ago

## 1. Description The Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents: - `POST /api/v1/termina...

go

No PRs yet

Statamic Vulnerable to CSV formula injection in form submission exports

GHSA-h77m-qrj7-jxcw CVE-2026-54243 MODERATE about 1 month ago

### Impact Form submission values were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value be...

packagist

No PRs yet

Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)

GHSA-v5c4-wcpj-x73m CVE-2026-54242 MODERATE about 1 month ago

### Impact The Glide image proxy's URL validation could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, b...

packagist

No PRs yet

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

GHSA-5c25-7vpj-9mqh CVE-2026-53519 CRITICAL about 1 month ago

### Summary `fallbackToFrontend` in the dashboard's `NoRoute` handler treats any URL whose **raw string** starts with `/dashboard` as an admin-fron...

go

No PRs yet

Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context

GHSA-39g2-8x68-pmx8 CVE-2026-53521 MODERATE about 1 month ago

## Summary `PATCH /server/{id}` accepts and persists nonexistent `ddns_profiles` IDs for a member-owned server. If another user later creates a DD...

go

No PRs yet

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

GHSA-x6fg-52vr-hj4w CVE-2026-53520 MODERATE about 1 month ago

### Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose `domain` is equal to the dashboard's own H...

go

No PRs yet

pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

GHSA-rxhj-4m44-96r4 CVE-2026-50015 HIGH about 1 month ago

## Summary pnpm's patch application pipeline (`@pnpm/patch-package`) performs no path validation on file paths extracted from `.patch` files. An a...

npm

No PRs yet

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

GHSA-cjhr-43r9-cfmw CVE-2026-50017 MODERATE about 1 month ago

## Summary pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local `.npmrc` file. In the repr...

npm

No PRs yet

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

GHSA-hwx4-2j3j-g496 CVE-2026-50016 HIGH about 1 month ago

## Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later...

npm

No PRs yet

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

GHSA-p4xf-rf54-rj3x CVE-2026-50014 MODERATE about 1 month ago

## Summary pnpm passes the lockfile-controlled git `resolution.commit` value to `git fetch` without a `--` separator or commit-format validation. ...

npm

No PRs yet

pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field

GHSA-q6j5-fjx5-2mc3 CVE-2026-50021 MODERATE about 1 month ago

## Summary pnpm's tarball extraction worker skips integrity verification when the `integrity` field is absent from the lockfile resolution. If an ...

npm

No PRs yet

pnpm: Unsafe default behavior breaks integrity check

GHSA-54hh-g5mx-jqcp CVE-2026-50573 MODERATE about 1 month ago

While it is unclear whether this should be classified as a vulnerability, it is being reported through this channel because the current behavior ma...

npm

No PRs yet

ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature bypass

GHSA-8jgf-23q5-x7xx CVE-2026-47074 HIGH about 1 month ago

### Summary `ExAws.SNS.verify_message/1` fetches the signing certificate from the `SigningCertURL` field of the incoming SNS message without valid...

hex

No PRs yet

js-toml has silent type confusion via falsy-primitive duplicate-key bypass

GHSA-m34p-749j-x6m6 CVE-2026-50029 MODERATE about 1 month ago

### Summary `js-toml`'s interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in...

npm

No PRs yet

regclient may leak authentication credentials to external blob stores

GHSA-qvqc-4c52-x6qp CVE-2026-49349 MODERATE about 1 month ago

Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malici...

go

No PRs yet

Authelia has an Edge Case Access Control Rule Mismatch

GHSA-j748-h363-wqj8 CVE-2026-48794 LOW about 1 month ago

### Impact **CVSSv4 Baseline Score:** Low 2.4 **CVSSv4 Weighted Score:** Low 1.3 The full CVSSv4 Vector for this vulnerability is: > CVSS:4.0/A...

go

No PRs yet

Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

GHSA-q6xx-5vr8-p898 CRITICAL about 1 month ago

### Summary In nezha **v1.14.13–v1.14.14** and **v2.0.0–v2.0.9**, the WebSocket endpoints `GET /ws/terminal/:id` and `GET /ws/file/:id` authentica...

go

No PRs yet

Blnk has an API key authorization bypass in owner and scope enforcement

GHSA-wcr3-9x4c-f5gj HIGH about 1 month ago

Blnk API key endpoints had an authorization issue that allowed non-master API keys to perform key-management actions outside their intended authori...

go

No PRs yet

YARD static cache reads raw traversal paths before router sanitization

GHSA-pxcc-8665-phx8 CVE-2026-49342 MODERATE about 1 month ago

### Summary YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root...

rubygems

No PRs yet

@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter

GHSA-396q-4vc8-28x9 CVE-2026-49336 MODERATE about 1 month ago

### Summary `@microsoft/kiota-http-fetchlibrary`'s `RedirectHandler` is documented as stripping `Authorization` and `Cookie` from cross-origin red...

npm

No PRs yet

js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

GHSA-wp3c-266w-4qfq CVE-2026-49293 HIGH about 1 month ago

## Summary `js-toml` versions up to and including **1.1.0** parse hexadecimal / octal / binary integer literals via a hand-written `parseBigInt` l...

npm

No PRs yet

SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings

GHSA-7vfx-4246-jcfh HIGH about 1 month ago

## Summary Four authorization bypass vulnerabilities in Symfony LiveComponent actions allow any authenticated user within a company to access, mod...

packagist

No PRs yet

Statamic CMS's unsafe method invocation via collection sorting allows data destruction

GHSA-m92m-r54r-x8r2 CVE-2026-49287 HIGH about 1 month ago

### Impact The fix for GHSA-4jjr-vmv7-wh4w was incomplete. It addressed the issue in the query builder, but the same protection was not applied to...

packagist

No PRs yet

Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources

GHSA-2497-6pwj-pwg7 CVE-2026-49288 MODERATE about 1 month ago

### Impact An authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries...

packagist

No PRs yet

PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option

GHSA-x8g9-h984-pc36 CVE-2026-49359 MODERATE about 1 month ago

### Summary `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a UR...

packagist

No PRs yet

PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

GHSA-5g9f-cwwg-4p8g CVE-2026-49358 LOW about 1 month ago

### Summary `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a register...

packagist

No PRs yet

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

GHSA-2fmj-p74r-3wjm CVE-2026-49286 HIGH about 1 month ago

### Summary `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist: ```php...

packagist

No PRs yet

Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes

GHSA-9653-rcfr-5c62 CVE-2026-47067 HIGH about 1 month ago

### Summary [CVE-2026-47067](https://nvd.nist.gov/vuln/detail/CVE-2026-47067) is an atom table exhaustion vulnerability (CWE-770) in hackney's URL...

hex

No PRs yet

Hackney has unbounded buffer accumulation in WebSocket

GHSA-q8jg-fgj4-fphf CVE-2026-47073 HIGH about 1 month ago

### Summary The WebSocket client in `src/hackney_ws.erl` imposes no upper bound on memory consumption across three distinct code paths. In each ca...

hex

No PRs yet

Hackney has CRLF / header injection in WebSocket upgrade request

GHSA-f9vr-g2g2-x9fg CVE-2026-47072 MODERATE about 1 month ago

### Summary CRLF injection in hackney's WebSocket upgrade request builder (`src/hackney_ws.erl`). `init/1` copies the `host`, `path`, `headers`, a...

hex

No PRs yet

Hackney has CR/LF injection in query parameter

GHSA-j9wq-vxxc-94wf CVE-2026-47075 MODERATE about 1 month ago

### Summary `hackney_url:make_url/3` passes the URL query component directly into the HTTP/1.1 request target without percent-encoding `\r` or `\n...

hex

No PRs yet

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

GHSA-jq4m-q6p2-8gwc CVE-2026-47077 HIGH about 1 month ago

### Summary `hackney_h3:await_response_loop/6` in `src/hackney_h3.erl` accumulates the HTTP/3 response body in memory without any size cap. The `a...

hex

No PRs yet

Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body

GHSA-h73q-4w9q-82h4 CVE-2026-47070 MODERATE about 1 month ago

### Summary The HTTP/3 redirect handler in `src/hackney_h3.erl` forwards the original request headers (`Authorization`, `Cookie`, `Proxy-Authoriza...

hex

No PRs yet

Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host

GHSA-pj7v-xfvx-wmjq CVE-2026-47076 MODERATE about 1 month ago

### Summary `hackney_url:normalize/2` URL-decodes the host component of a parsed URL, but the caller's SSRF allowlist runs before normalization us...

hex

No PRs yet

Hackney has CRLF / header injection via unvalidated `domain` and `path` options

GHSA-mp55-p8c9-rfw2 CVE-2026-47069 LOW about 1 month ago

### Summary CRLF injection in `hackney_cookie:setcookie/3` (`src/hackney_cookie.erl`). The function validates `Name` and `Value` against CR/LF and...

hex

No PRs yet

Hackney: `ssl:connect/2` post-handshake upgrade has no timeout

GHSA-gp9c-pm5m-5cxr CVE-2026-47071 HIGH about 1 month ago

### Summary The SOCKS5 transport in `src/hackney_socks5.erl` correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but th...

hex

No PRs yet

Hackney has an infinite loop on non-token byte at start of an Alt-Svc entry

GHSA-6cp8-v795-jr2j CVE-2026-47066 HIGH about 1 month ago

### Summary [CVE-2026-47066](https://nvd.nist.gov/vuln/detail/CVE-2026-47066) is an infinite loop (CWE-835) in hackney's Alt-Svc response header p...

hex

No PRs yet

Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication

GHSA-4hf8-5mjm-rfgq CVE-2026-49357 HIGH about 1 month ago

# Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication ## Summary `line-desktop-mcp` supports a `--http-mode` Str...

npm

No PRs yet

Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

GHSA-mmj8-wcvw-6789 CVE-2026-49262 LOW about 1 month ago

### Summary The administrative proxy route (`cmsproxy`) in Aimeos Pagible CMS is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS ...

packagist

No PRs yet

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

GHSA-hg3w-7f8c-63hp CVE-2026-48995 MODERATE about 1 month ago

### Summary A malicious `codeload.github.com` server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. ###...

npm

No PRs yet

Cargo crates in third party registries can override the cached source of other crates

GHSA-jq42-7mfv-hm57 CVE-2026-5223 MODERATE about 1 month ago

The Rust Security Response Team was notified that Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registrie...

cargo

5

Dependabot PRs

Cargo can be coerced to share credentials between registries

GHSA-p688-r7jv-fm6f CVE-2026-5222 LOW about 1 month ago

The Rust Security Response Team was notified that Cargo incorrectly normalized the URLs of third-party registries using the [sparse index protocol]...

cargo

5

Dependabot PRs

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

GHSA-f5gc-qxf8-mh9g CVE-2026-49260 HIGH about 1 month ago

### Summary `pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `escapeshellarg()` first and t...

packagist

No PRs yet

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

GHSA-c6v2-3ffm-vcmc CVE-2026-49258 HIGH about 1 month ago

## Summary The web UI (`/ui/*`) does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-ad...

go

No PRs yet

phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

GHSA-985r-q3qp-299h HIGH about 1 month ago

## Advisory / Disclosure # phpMyFAQ 4.1.3 — incomplete fix for the admin-API IDOR/privilege-escalation class **Target:** thorsten/phpMyFAQ (compo...

packagist

No PRs yet

@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url

GHSA-rp72-5v5q-2446 LOW about 1 month ago

## Summary `@cardano402/mcp-server` versions `<= 0.1.1` ship three security gaps that can lead to unauthorized fund movement when the package is us...

npm

No PRs yet

mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

GHSA-73cv-556c-w3g6 CVE-2026-49257 CRITICAL about 1 month ago

## Resolution Fixed in [v3.1.0](https://github.com/startreedata/mcp-pinot/releases/tag/v3.1.0), released 2026-05-25. The fix was merged in [PR #95...

pypi

No PRs yet

Relyra SAML SignatureValue not cryptographically verified -> authentication bypass

GHSA-jv46-xfwm-36j7 CVE-2026-49454 CRITICAL about 1 month ago

## Summary Relyra `1.0.0` and `1.1.0` accept forged SAML signatures because `SignatureValue` was not cryptographically verified before the library...

hex

No PRs yet

mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call

GHSA-2r68-g678-7qr3 CVE-2026-49291 HIGH about 1 month ago

## Summary The HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to ha...

pypi

No PRs yet