Incus has an arbitrary file write on host via `exec-output` symlink in crafted image

GHSA-73hr-m85f-64v9 CVE-2026-48750 CRITICAL about 1 month ago

### Summary The `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory ...

go

No PRs yet

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image

GHSA-2q3f-q5pq-g8wv CVE-2026-48749 CRITICAL about 1 month ago

### Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execu...

go

No PRs yet

ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments

GHSA-p9rq-q46c-g4x6 CVE-2026-53463 MODERATE about 1 month ago

When passing incorrect arguments in the distort operation a null pointer deference will occur.

nuget

No PRs yet

OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

GHSA-gf57-4mp6-m85x CVE-2026-46623 HIGH about 1 month ago

## Summary **Description** An Unverified Password Change (CWE-620) and Use of Weak Credentials (CWE-1391) issue in OpenAM's OAuth2 authentication...

maven

No PRs yet

OpenAM Authentication Bypass via MSISDN LDAP Injection

GHSA-xq73-fvmr-jvmm CVE-2026-46619 HIGH about 1 month ago

## Summary **Description** An LDAP Injection (CWE-90) vulnerability in the MSISDN authentication module allows an unauthenticated, remote attacke...

maven

No PRs yet

fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`

GHSA-2jc5-xhx8-qj6h CVE-2026-44163 MODERATE about 1 month ago

The `fluent-plugin-opentelemetry` plugin (specifically the `in_opentelemetry` HTTP input) lacked strict size limits on incoming requests. It was di...

rubygems

No PRs yet

fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3`

GHSA-xv9w-7v6q-hpjh CVE-2026-44162 LOW about 1 month ago

The `fluent-plugin-s3` plugin (specifically the `in_s3` input plugin) supports reading and decompressing heavily compressed files (such as `gzip`, ...

rubygems

No PRs yet

Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

GHSA-72f5-rr8c-r6gr CVE-2026-44161 HIGH about 1 month ago

The `out_http` output plugin allows the use of placeholders (such as `${tag}`) in the `endpoint` configuration parameter. It was discovered that if...

rubygems

No PRs yet

Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

GHSA-j9cw-hwqf-85w7 CVE-2026-44160 HIGH about 1 month ago

Fluentd's `in_http` and `in_forward` plugins support receiving gzip-compressed data. While Fluentd correctly enforces size limits on the incoming c...

rubygems

No PRs yet

Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API

GHSA-pr7j-96cj-549h CVE-2026-44025 HIGH about 1 month ago

Fluentd's Monitor Agent plugin (`in_monitor_agent`) exposes internal metrics and plugin information via a REST API. It was discovered that the API ...

rubygems

No PRs yet

Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

GHSA-44hj-4m45-frj3 CVE-2026-44024 CRITICAL about 1 month ago

Fluentd allows dynamically constructing file paths using the `${tag}` placeholder. It was discovered that validation for this placeholder was insuf...

rubygems

No PRs yet

ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails

GHSA-px7q-ggqj-hcf2 CVE-2026-53462 MODERATE about 1 month ago

When an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash.

nuget

No PRs yet

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes ...

CPANSA-Bytes-Random-Secure-2026-11625 CVE-2026-11625 about 1 month ago

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, o...

cpan

No PRs yet

Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will b...

CPANSA-Bytes-Random-Secure-Tiny-2026-11702 CVE-2026-11702 about 1 month ago

Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before for...

cpan

No PRs yet

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

GHSA-x527-x647-q7gg CVE-2026-46595 CRITICAL about 1 month ago

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than ...

go

No PRs yet

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

GHSA-5cgq-3rg8-m6cv CVE-2026-42508 CRITICAL about 1 month ago

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are che...

go

No PRs yet

golang.org/x/crypto vulnerable to infinite loop on large channel writes

GHSA-rm3j-f69w-wqmq CVE-2026-39834 CRITICAL about 1 month ago

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the...

go

No PRs yet

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

GHSA-89gr-r52h-f8rx CVE-2026-39831 CRITICAL about 1 month ago

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presenc...

go

No PRs yet

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

GHSA-w879-237q-wc7r CVE-2026-39829 HIGH about 1 month ago

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA par...

go

No PRs yet

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

GHSA-vgwf-h737-ff37 CVE-2026-39830 CRITICAL about 1 month ago

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked g...

go

No PRs yet

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

GHSA-qpw4-5x99-6vjp CVE-2026-39827 MODERATE about 1 month ago

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing t...

go

No PRs yet

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

GHSA-78mq-xcr3-xm33 CVE-2026-39835 MODERATE about 1 month ago

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client ...

go

No PRs yet

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

GHSA-45gg-vh54-h5m9 CVE-2026-39828 MODERATE about 1 month ago

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potent...

go

No PRs yet

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

GHSA-q4h4-gmj2-qvw2 CVE-2026-46597 HIGH about 1 month ago

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

go

No PRs yet

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

GHSA-f5wc-c3c7-36mc CVE-2026-39832 CRITICAL about 1 month ago

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destinat...

go

No PRs yet

golang.org/x/crypto doesn't enforce invoking key constraints

GHSA-jppx-rxg9-jmrx CVE-2026-39833 CRITICAL about 1 month ago

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sig...

go

No PRs yet

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

GHSA-9m57-25v3-79x9 CVE-2026-46598 MODERATE about 1 month ago

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

go

No PRs yet

Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

GHSA-v2wp-frmc-5q3v CVE-2026-55166 CRITICAL about 1 month ago

<!-- obsidian --><h1 data-heading="Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_u...

pypi

No PRs yet

Lemur: JWT verifier honors attacker-supplied alg, enabling ATO

GHSA-r9gp-7f88-9r54 CVE-2026-55165 MODERATE about 1 month ago

<!-- obsidian --><h1 data-heading="Lemur 1.9.0: JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent...

pypi

No PRs yet

Lemur user-update path stores plaintext passwords

GHSA-q437-g7fv-2jvv CVE-2026-55164 MODERATE about 1 month ago

## Summary `lemur.users.service.update()` writes a user's new password as plaintext to the `users.password` column. The `User` model wires bcrypt ...

pypi

No PRs yet

Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>

GHSA-x3vf-mgxj-7785 CVE-2026-55163 MODERATE about 1 month ago

## Summary The `PUT /api/1/roles/<id>` handler in `lemur/roles/views.py` gates only on `RoleMemberPermission(role_id).can()`, which is satisfied ...

pypi

No PRs yet

Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF

GHSA-54vg-pfh7-jq95 CVE-2026-55162 MODERATE about 1 month ago

## Summary When verifying an uploaded certificate, `lemur/certificates/verify.py` extracts the CRL Distribution Point URL and the OCSP responder ...

pypi

No PRs yet

ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop

GHSA-g22q-f7gc-5jhr CVE-2026-53461 HIGH about 1 month ago

An incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash.

nuget

No PRs yet

ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition

GHSA-q62c-h75r-2xhc CVE-2026-53460 HIGH about 1 month ago

A missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. ## Credit Aisle Research (Ze Sheng, D...

nuget

No PRs yet

ImageMagick: Policy Bypass can read disallowed files via symlink

GHSA-xcjm-wqff-m669 CVE-2026-49219 MODERATE about 1 month ago

An incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink.

nuget

No PRs yet

ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

GHSA-8pj9-6897-74xc CVE-2026-49218 HIGH about 1 month ago

A missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operations.

nuget

No PRs yet

ImageMagick has a Heap Buffer Over-Write in MAT decoder on 32-bit systems

GHSA-4v89-6mgq-6rgc CVE-2026-48994 MODERATE about 1 month ago

A missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems.

nuget

No PRs yet

ImageMagick Vulnerable to Stack Overflow in its MVG Decoder

GHSA-h36c-3666-h489 CVE-2026-48734 MODERATE about 1 month ago

A crafted MVG file could result in a stack overflow due to a missing depth or visited-set check.

nuget

No PRs yet

ImageMagick has an Infinite Loop in subimage-search with crafted image

GHSA-5v62-8fq6-cp9m CVE-2026-48733 MODERATE about 1 month ago

An infinite loop in the subimage-search operation can happen when using a crafted image.

nuget

No PRs yet

ImageMagick has a Heap Buffer Underwrite in the Floyd-Steinberg depth dithering method

GHSA-2hhq-c99x-492r CVE-2026-48724 MODERATE about 1 month ago

When using an image with mask the Floyd-Steinberg dithering method will cause a negative heap buffer over-write.

nuget

No PRs yet

nextflow auth login command has incorrect default permissions

GHSA-92qf-fcph-v5wr CVE-2026-48722 MODERATE about 1 month ago

### Impact `nextflow auth login` persists Seqera Platform OIDC tokens to `${NXF_HOME:-~/.nextflow}/seqera-auth.config`. The file is created via Ja...

maven

No PRs yet

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

GHSA-47q9-m4ww-924m CVE-2026-48702 HIGH about 1 month ago

## Description The `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file ...

go

No PRs yet

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

GHSA-pjp5-fpmr-3349 CVE-2026-48529 MODERATE about 1 month ago

### Summary When running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized w...

go

No PRs yet

MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments

GHSA-qhmf-xw27-6rqr CVE-2026-48517 MODERATE about 1 month ago

## Summary MessagePack-CSharp's typeless deserialization includes `MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type)` as a s...

nuget

No PRs yet

MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings

GHSA-q2h6-ghwm-5qm8 CVE-2026-48516 MODERATE about 1 month ago

## Summary `InterfaceLookupFormatter<TKey,TElement>` constructs an internal `Dictionary<TKey, IGrouping<TKey,TElement>>` with the default equality...

nuget

No PRs yet

MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions

GHSA-cxmj-83gh-fp49 CVE-2026-48515 MODERATE about 1 month ago

## Summary MessagePack-CSharp's multi-dimensional array formatters read dimension lengths directly from the payload and allocate `T[,]`, `T[,,]`, ...

nuget

No PRs yet

MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length

GHSA-w567-gjr2-hm5j CVE-2026-48514 MODERATE about 1 month ago

## Summary `UnsafeBlitFormatterBase<T>.Deserialize` reads an attacker-controlled `byteLength` from an extension payload and allocates an array bas...

nuget

No PRs yet

MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement

GHSA-wfr3-xj75-pfwh CVE-2026-48513 MODERATE about 1 month ago

## Summary Runtime-generated union deserializers emitted by `DynamicUnionResolver` do not call `MessagePackSecurity.DepthStep(ref reader)` and do ...

nuget

No PRs yet

MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement

GHSA-cj9g-3mj2-g8vv CVE-2026-48512 MODERATE about 1 month ago

## Summary MessagePack-CSharp's JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit. These pat...

nuget

No PRs yet

MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

GHSA-2x83-8g95-xh59 CVE-2026-48511 MODERATE about 1 month ago

## Summary `ExpandoObjectFormatter.Deserialize` populates `System.Dynamic.ExpandoObject` by calling `IDictionary<string, object>.Add` for each map...

nuget

No PRs yet