Lemur has an authorization bypass in StrictRolePermission / AuthorityCreatorPermission

GHSA-qcqw-jwxc-2hqg CVE-2026-48508 HIGH about 1 month ago

## Summary `StrictRolePermission` and `AuthorityCreatorPermission` in `lemur/auth/permissions.py` call `flask_principal.Permission.__init__()` wit...

pypi

No PRs yet

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

GHSA-vh6j-jc39-fggf CVE-2026-48506 HIGH about 1 month ago

## Summary `MessagePackReader.TrySkip()` recursively descends into nested arrays and maps without incrementing the reader depth or calling the con...

nuget

No PRs yet

Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission

GHSA-mc5j-f6wx-h9qh CVE-2026-48505 HIGH about 1 month ago

A flaw in the handling of recovery codes for **app-based multi-factor authentication** allows the same recovery code to be reused via concurrent su...

packagist

No PRs yet

opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation

GHSA-w9wp-h8wv-79jx CVE-2026-48504 MODERATE about 1 month ago

## Summary `BaggagePropagator::extract_with_context` in `opentelemetry_sdk` did not enforce the W3C Baggage size limits before parsing an inbound ...

cargo

No PRs yet

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

GHSA-382j-8mxh-c7x2 CVE-2026-48502 HIGH about 1 month ago

## Summary `MessagePackReader.ReadDateTime()` can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow ...

nuget

No PRs yet

amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()

GHSA-g697-2xrc-gc46 CVE-2026-9291 HIGH about 1 month ago

**Summary** Amazon Braket SDK is an open-source Python library for interacting with the Amazon Braket quantum computing service, including managing...

pypi

No PRs yet

LangGraph SDK has unsafe URL path construction

GHSA-w39p-vh2g-g8g5 CVE-2026-48776 MODERATE about 1 month ago

## Summary `langgraph-sdk` constructs HTTP request paths for resource operations by interpolating caller-supplied identifier values into URL templ...

pypi

No PRs yet

LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

GHSA-fjqc-hq36-qh5p CVE-2026-48775 MODERATE about 1 month ago

## Summary LangGraph's `JsonPlusSerializer` can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could mod...

pypi

No PRs yet

chi Has an IP Spoofing Vulnerability in `middleware.RealIP`

GHSA-3fxj-6jh8-hvhx MODERATE about 1 month ago

## Summary The `RealIP` middleware in `go-chi/chi` is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the `X-Fo...

go

6

Dependabot PRs

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

GHSA-rjr7-jggh-pgcp HIGH about 1 month ago

### Summary realip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass ra...

go

6

Dependabot PRs

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

GHSA-9g5q-2w5x-hmxf HIGH about 1 month ago

### Summary The vulnerability allows the `Request.RemoteAddr` to be spoofed when determining the request source IP via the `X-Forwarded-For` header...

go

6

Dependabot PRs

FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks

GHSA-r4v7-6wcg-ghj5 MODERATE about 1 month ago

### Summary The `/api/auth/login` endpoint does not implement rate limiting, account lockout, or progressive backoff for repeated authentication fa...

go

No PRs yet

fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`

GHSA-fq3w-p4fg-mw73 LOW about 1 month ago

### Impact Affects: Anyone who generates the UNIX man pages in Fuji <= `0.8.0` build with the `dev` crate feature. Consequences: `/usr/share/man/ma...

cargo

No PRs yet

neotoma has tenant isolation gap in relationship query endpoints

GHSA-wrr4-782v-jhwh LOW about 1 month ago

## Summary The `/list_relationships` and `/retrieve_graph_neighborhood` endpoints call `getAuthenticatedUserId` (confirming a valid session exists...

npm

No PRs yet

justhtml: to_markdown() code-span blank-line breakout enables XSS

GHSA-jf6w-2mvx-633j MODERATE about 1 month ago

# justhtml: to_markdown() code-span blank-line breakout enables XSS ### Summary In `justhtml` 0.9.0 through 1.21.0, `to_markdown()` renders `<cod...

pypi

No PRs yet

i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

GHSA-2933-q333-qg83 CVE-2026-48713 CRITICAL about 1 month ago

### Impact `i18next-fs-backend` ≤ 2.6.5, when used to persist missing translation keys (e.g. via `i18next-http-middleware`'s `missingKeyHandler` e...

npm

25

Dependabot PRs

i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

GHSA-f49m-vf83-692w CVE-2026-48714 CRITICAL about 1 month ago

### Impact `i18next-http-middleware` ≤ 3.9.6's `missingKeyHandler` blocked the literal request-body keys `__proto__`, `constructor`, and `prototyp...

npm

25

Dependabot PRs

OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing

GHSA-386j-6m86-78f9 CVE-2026-46560 HIGH about 1 month ago

## Summary **Description** An Improper Verification of Cryptographic Signature (CWE-347) issue in OpenAM's RADIUS authentication module allows an...

maven

No PRs yet

OpenAM Arbitrary OAuth Token Minting via Push Registration

GHSA-cj8f-2fhf-826r CVE-2026-46498 HIGH about 1 month ago

## Summary **Description** An Authorization Bypass Through User-Controlled Key (CWE-639) exists in OpenAM's stateful OAuth2 token-read path. Unde...

maven

No PRs yet

@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write

GHSA-4vp2-6q8c-pvq2 CVE-2026-46406 MODERATE about 1 month ago

The Claude Code `/copy` command wrote responses to a hardcoded, predictable path (`/tmp/claude/response.md`) without UID isolation, randomness, or ...

npm

No PRs yet

OpenAM has Unsafe Java Deserialization via SNS

GHSA-pp89-732f-3g8q CVE-2026-45794 HIGH about 1 month ago

## Summary **Description** A Deserialization of Untrusted Data (CWE-502) issue exists in OpenAM's Push Notification SNS callback resource. The RE...

maven

No PRs yet

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by the block into a heap buffer sized to the longer input array, then grows the buffer before each copy wit...

CPANSA-List-SomeUtils-XS-2026-12844 CVE-2026-12844 about 1 month ago

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by...

cpan

No PRs yet

Angular's deprecated package has a Cross-Site Scripting issue

GHSA-7x27-g8rg-x87w CVE-2026-11998 HIGH about 1 month ago

A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaS...

npm

No PRs yet

OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

GHSA-prj9-97mp-mwh2 CVE-2026-53541 MODERATE about 1 month ago

### Description The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the act...

go

No PRs yet

OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration

GHSA-f637-w7p2-m7fx CVE-2026-48709 LOW about 1 month ago

## Summary The `ValidateArgumentType` RPC endpoint in `service/internal/api/api.go` does not perform any authentication or authorization checks. U...

go

No PRs yet

OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

GHSA-7fq5-7wr8-rjwj CVE-2026-48708 HIGH about 1 month ago

## Summary OliveTin's template engine uses a **single shared `text/template.Template` instance** (`tpl` package-level variable in `service/interna...

go

No PRs yet

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

GHSA-p462-xxwx-pqf4 CVE-2026-45052 CRITICAL about 1 month ago

## Summary **Description** An Improper Authorization (CWE-285) issue in OpenAM's Liberty Web Services SOAP receiver allows an unauthenticated rem...

maven

No PRs yet

OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

GHSA-6c99-87fr-6q7r CVE-2026-45051 CRITICAL about 1 month ago

## Summary **Description** A deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module. Under c...

maven

No PRs yet

Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

GHSA-pwpj-p52h-q484 CVE-2026-54329 HIGH about 1 month ago

### Impact A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) i...

packagist

No PRs yet

Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL

GHSA-6mmj-jhqj-6c6q CVE-2026-55542 LOW about 1 month ago

### Impact Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know...

packagist

No PRs yet

Snipe-IT has Improper Authorization in File Deletion (IDOR)

GHSA-x667-r589-43m7 CVE-2026-55519 LOW about 1 month ago

### Impact A vulnerability was identified in Snipe-IT v8.4.0 (build 21280-g91a95dbc6) that allows any authenticated user with generic asset edit pe...

packagist

No PRs yet

Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation

GHSA-hf68-g98v-wp9g CVE-2026-55483 MODERATE about 1 month ago

### Impact The `store()` method in both the web and API `UsersController` only strips the superuser permission when a non-superuser creates a user....

packagist

No PRs yet

Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update

GHSA-33g4-646g-qwmm CVE-2026-55482 MODERATE about 1 month ago

### Impact The `BulkAssetsController::update()` method accepts `company_id` directly from user input without calling `Company::getIdForCurrentUser(...

packagist

No PRs yet

Snipe-IT has a 2FA reset privilege bypass

GHSA-6x4j-8954-5hxm CVE-2026-50550 MODERATE about 1 month ago

### Impact A user who can edit other users could reset a superadmin's 2FA. ### Patches Patched in 8.5.0

packagist

No PRs yet

Snipe-IT Vulnerable to User Account Escalation via CSV Import

GHSA-p68w-rgmg-3c2v CVE-2026-49976 MODERATE about 1 month ago

### Impact The CSV user import in update mode bypasses user-edit authorization. A user with only the `import` permission can overwrite any non-admi...

packagist

No PRs yet

Flask-Security has an Open Redirect issue

GHSA-w2j7-f3c6-g8cw MODERATE about 1 month ago

# Open Redirect in Flask-Security ## Summary `flask_security.utils.validate_redirect_url()` can allow an attacker-controlled redirect URL when su...

pypi

No PRs yet

Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

GHSA-mr8g-2mj4-pcq2 CVE-2026-49870 MODERATE about 1 month ago

### Impact `POST /two-factor` had no rate limiting, lockout, or attempt counter. An attacker with valid credentials can submit unlimited TOTP guess...

packagist

No PRs yet

phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

GHSA-8c6h-7g6x-m5x4 CVE-2026-49205 MODERATE about 1 month ago

Missing Authorization in API CategoryController — CVE-2026-24421 fixed BackupController by adding userHasPermission(PermissionType::BACKUP). The s...

packagist

No PRs yet

Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

GHSA-6f75-x745-xcpr CVE-2026-48507 HIGH about 1 month ago

### Impact The vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by ...

packagist

No PRs yet

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree

GHSA-wcmj-x466-56mm MODERATE about 1 month ago

## Summary If a symlink already exists under the `.terraform/providers` directory where a provider package needs to be installed, `tofu init` woul...

go

No PRs yet

Filament: Unauthenticated temporary file upload on auth pages

GHSA-44wp-g8f4-f4v5 CVE-2026-48500 MODERATE about 1 month ago

Any schema can contain a file upload form field, so Filament applies Livewire's `WithFileUploads` trait to the Livewire component the schema is emb...

packagist

No PRs yet

opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

GHSA-f2r5-5m7w-p5cx CVE-2026-48496 MODERATE about 1 month ago

### Summary An unprivileged process can easily trigger the `processPIDEvents` goroutine to be blocked indefinitely, preventing the goroutine from ...

go

No PRs yet

Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

GHSA-52fw-7fw2-fmv5 CVE-2026-48493 MODERATE about 1 month ago

### Impact A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission exc...

packagist

No PRs yet

Snipe-IT's selectlist visibility is too permissive

GHSA-f3c5-6cw8-fg57 CVE-2026-48492 MODERATE about 1 month ago

### Impact The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of p...

packagist

No PRs yet

phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

GHSA-58fg-62fg-3fcj CVE-2026-48488 LOW about 1 month ago

### Summary Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks sinc...

packagist

No PRs yet

OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation

GHSA-r6fj-869h-4f6q CVE-2026-48480 MODERATE about 1 month ago

The codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the...

maven

No PRs yet

Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS

GHSA-3fc8-8hp6-6jr4 CVE-2026-48167 MODERATE about 1 month ago

The `ImageColumn` and `ImageEntry` components render raw database values without escaping HTML. Where the data passed to these components isn't val...

packagist

No PRs yet

Filament: Timing-based user enumeration on login page

GHSA-5w46-g9pq-wh6f CVE-2026-48166 MODERATE about 1 month ago

The login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is li...

packagist

No PRs yet

Slim has Reflected XSS in the HtmlErrorRenderer

GHSA-53h4-8rc4-f539 CVE-2026-48157 MODERATE about 1 month ago

### Impact If an application uses `HttpException::setTitle()` and/or `setDescription()` to include untrusted/request-derived data in the error tit...

packagist

1

Dependabot PRs

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

GHSA-jc3j-x6pg-4hmv CVE-2026-48126 HIGH about 1 month ago

### Summary When algernon is started with `--domain` (or `--letsencrypt`, which silently turns on `--domain` at `engine/flags.go:372`), the reques...

go

No PRs yet