MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length

GHSA-w567-gjr2-hm5j CVE-2026-48514 MODERATE about 1 month ago

## Summary `UnsafeBlitFormatterBase<T>.Deserialize` reads an attacker-controlled `byteLength` from an extension payload and allocates an array bas...

nuget

No PRs yet

MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement

GHSA-wfr3-xj75-pfwh CVE-2026-48513 MODERATE about 1 month ago

## Summary Runtime-generated union deserializers emitted by `DynamicUnionResolver` do not call `MessagePackSecurity.DepthStep(ref reader)` and do ...

nuget

No PRs yet

MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement

GHSA-cj9g-3mj2-g8vv CVE-2026-48512 MODERATE about 1 month ago

## Summary MessagePack-CSharp's JSON conversion helpers contain multiple recursion paths that do not consistently enforce a depth limit. These pat...

nuget

No PRs yet

MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

GHSA-2x83-8g95-xh59 CVE-2026-48511 MODERATE about 1 month ago

## Summary `ExpandoObjectFormatter.Deserialize` populates `System.Dynamic.ExpandoObject` by calling `IDictionary<string, object>.Add` for each map...

nuget

No PRs yet

MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

GHSA-v72x-2h86-7f8m CVE-2026-48510 MODERATE about 1 month ago

## Summary When MessagePack-CSharp decompresses `Lz4Block` or `Lz4BlockArray` payloads, it reads declared uncompressed lengths from the wire and a...

nuget

No PRs yet

MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

GHSA-2f33-pr97-265q CVE-2026-48509 MODERATE about 1 month ago

## Summary The parameterless `MessagePackInputFormatter()` constructor uses default serializer options, which resolve to `MessagePackSerializerOpt...

nuget

No PRs yet

Lemur has an authorization bypass in StrictRolePermission / AuthorityCreatorPermission

GHSA-qcqw-jwxc-2hqg CVE-2026-48508 HIGH about 1 month ago

## Summary `StrictRolePermission` and `AuthorityCreatorPermission` in `lemur/auth/permissions.py` call `flask_principal.Permission.__init__()` wit...

pypi

No PRs yet

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

GHSA-vh6j-jc39-fggf CVE-2026-48506 HIGH about 1 month ago

## Summary `MessagePackReader.TrySkip()` recursively descends into nested arrays and maps without incrementing the reader depth or calling the con...

nuget

No PRs yet

Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission

GHSA-mc5j-f6wx-h9qh CVE-2026-48505 HIGH about 1 month ago

A flaw in the handling of recovery codes for **app-based multi-factor authentication** allows the same recovery code to be reused via concurrent su...

packagist

No PRs yet

opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation

GHSA-w9wp-h8wv-79jx CVE-2026-48504 MODERATE about 1 month ago

## Summary `BaggagePropagator::extract_with_context` in `opentelemetry_sdk` did not enforce the W3C Baggage size limits before parsing an inbound ...

cargo

No PRs yet

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

GHSA-382j-8mxh-c7x2 CVE-2026-48502 HIGH about 1 month ago

## Summary `MessagePackReader.ReadDateTime()` can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow ...

nuget

No PRs yet

amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()

GHSA-g697-2xrc-gc46 CVE-2026-9291 HIGH about 1 month ago

**Summary** Amazon Braket SDK is an open-source Python library for interacting with the Amazon Braket quantum computing service, including managing...

pypi

No PRs yet

LangGraph SDK has unsafe URL path construction

GHSA-w39p-vh2g-g8g5 CVE-2026-48776 MODERATE about 1 month ago

## Summary `langgraph-sdk` constructs HTTP request paths for resource operations by interpolating caller-supplied identifier values into URL templ...

pypi

No PRs yet

LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

GHSA-fjqc-hq36-qh5p CVE-2026-48775 MODERATE about 1 month ago

## Summary LangGraph's `JsonPlusSerializer` can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could mod...

pypi

No PRs yet

chi Has an IP Spoofing Vulnerability in `middleware.RealIP`

GHSA-3fxj-6jh8-hvhx MODERATE about 1 month ago

## Summary The `RealIP` middleware in `go-chi/chi` is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the `X-Fo...

go

6

Dependabot PRs

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

GHSA-rjr7-jggh-pgcp HIGH about 1 month ago

### Summary realip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass ra...

go

6

Dependabot PRs

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

GHSA-9g5q-2w5x-hmxf HIGH about 1 month ago

### Summary The vulnerability allows the `Request.RemoteAddr` to be spoofed when determining the request source IP via the `X-Forwarded-For` header...

go

6

Dependabot PRs

FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks

GHSA-r4v7-6wcg-ghj5 MODERATE about 1 month ago

### Summary The `/api/auth/login` endpoint does not implement rate limiting, account lockout, or progressive backoff for repeated authentication fa...

go

No PRs yet

fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`

GHSA-fq3w-p4fg-mw73 LOW about 1 month ago

### Impact Affects: Anyone who generates the UNIX man pages in Fuji <= `0.8.0` build with the `dev` crate feature. Consequences: `/usr/share/man/ma...

cargo

No PRs yet

neotoma has tenant isolation gap in relationship query endpoints

GHSA-wrr4-782v-jhwh LOW about 1 month ago

## Summary The `/list_relationships` and `/retrieve_graph_neighborhood` endpoints call `getAuthenticatedUserId` (confirming a valid session exists...

npm

No PRs yet

justhtml: to_markdown() code-span blank-line breakout enables XSS

GHSA-jf6w-2mvx-633j MODERATE about 1 month ago

# justhtml: to_markdown() code-span blank-line breakout enables XSS ### Summary In `justhtml` 0.9.0 through 1.21.0, `to_markdown()` renders `<cod...

pypi

No PRs yet

i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

GHSA-2933-q333-qg83 CVE-2026-48713 CRITICAL about 1 month ago

### Impact `i18next-fs-backend` ≤ 2.6.5, when used to persist missing translation keys (e.g. via `i18next-http-middleware`'s `missingKeyHandler` e...

npm

25

Dependabot PRs

i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

GHSA-f49m-vf83-692w CVE-2026-48714 CRITICAL about 1 month ago

### Impact `i18next-http-middleware` ≤ 3.9.6's `missingKeyHandler` blocked the literal request-body keys `__proto__`, `constructor`, and `prototyp...

npm

25

Dependabot PRs

OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing

GHSA-386j-6m86-78f9 CVE-2026-46560 HIGH about 1 month ago

## Summary **Description** An Improper Verification of Cryptographic Signature (CWE-347) issue in OpenAM's RADIUS authentication module allows an...

maven

No PRs yet

OpenAM Arbitrary OAuth Token Minting via Push Registration

GHSA-cj8f-2fhf-826r CVE-2026-46498 HIGH about 1 month ago

## Summary **Description** An Authorization Bypass Through User-Controlled Key (CWE-639) exists in OpenAM's stateful OAuth2 token-read path. Unde...

maven

No PRs yet

@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write

GHSA-4vp2-6q8c-pvq2 CVE-2026-46406 MODERATE about 1 month ago

The Claude Code `/copy` command wrote responses to a hardcoded, predictable path (`/tmp/claude/response.md`) without UID isolation, randomness, or ...

npm

No PRs yet

OpenAM has Unsafe Java Deserialization via SNS

GHSA-pp89-732f-3g8q CVE-2026-45794 HIGH about 1 month ago

## Summary **Description** A Deserialization of Untrusted Data (CWE-502) issue exists in OpenAM's Push Notification SNS callback resource. The RE...

maven

No PRs yet

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by the block into a heap buffer sized to the longer input array, then grows the buffer before each copy wit...

CPANSA-List-SomeUtils-XS-2026-12844 CVE-2026-12844 about 1 month ago

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by...

cpan

No PRs yet

Angular's deprecated package has a Cross-Site Scripting issue

GHSA-7x27-g8rg-x87w CVE-2026-11998 HIGH about 1 month ago

A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaS...

npm

No PRs yet

OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

GHSA-prj9-97mp-mwh2 CVE-2026-53541 MODERATE about 1 month ago

### Description The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the act...

go

No PRs yet

OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration

GHSA-f637-w7p2-m7fx CVE-2026-48709 LOW about 1 month ago

## Summary The `ValidateArgumentType` RPC endpoint in `service/internal/api/api.go` does not perform any authentication or authorization checks. U...

go

No PRs yet

OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

GHSA-7fq5-7wr8-rjwj CVE-2026-48708 HIGH about 1 month ago

## Summary OliveTin's template engine uses a **single shared `text/template.Template` instance** (`tpl` package-level variable in `service/interna...

go

No PRs yet

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

GHSA-p462-xxwx-pqf4 CVE-2026-45052 CRITICAL about 1 month ago

## Summary **Description** An Improper Authorization (CWE-285) issue in OpenAM's Liberty Web Services SOAP receiver allows an unauthenticated rem...

maven

No PRs yet

OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

GHSA-6c99-87fr-6q7r CVE-2026-45051 CRITICAL about 1 month ago

## Summary **Description** A deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module. Under c...

maven

No PRs yet

Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

GHSA-pwpj-p52h-q484 CVE-2026-54329 HIGH about 1 month ago

### Impact A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) i...

packagist

No PRs yet

Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL

GHSA-6mmj-jhqj-6c6q CVE-2026-55542 LOW about 1 month ago

### Impact Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know...

packagist

No PRs yet

Snipe-IT has Improper Authorization in File Deletion (IDOR)

GHSA-x667-r589-43m7 CVE-2026-55519 LOW about 1 month ago

### Impact A vulnerability was identified in Snipe-IT v8.4.0 (build 21280-g91a95dbc6) that allows any authenticated user with generic asset edit pe...

packagist

No PRs yet

Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation

GHSA-hf68-g98v-wp9g CVE-2026-55483 MODERATE about 1 month ago

### Impact The `store()` method in both the web and API `UsersController` only strips the superuser permission when a non-superuser creates a user....

packagist

No PRs yet

Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update

GHSA-33g4-646g-qwmm CVE-2026-55482 MODERATE about 1 month ago

### Impact The `BulkAssetsController::update()` method accepts `company_id` directly from user input without calling `Company::getIdForCurrentUser(...

packagist

No PRs yet

Snipe-IT has a 2FA reset privilege bypass

GHSA-6x4j-8954-5hxm CVE-2026-50550 MODERATE about 1 month ago

### Impact A user who can edit other users could reset a superadmin's 2FA. ### Patches Patched in 8.5.0

packagist

No PRs yet

Snipe-IT Vulnerable to User Account Escalation via CSV Import

GHSA-p68w-rgmg-3c2v CVE-2026-49976 MODERATE about 1 month ago

### Impact The CSV user import in update mode bypasses user-edit authorization. A user with only the `import` permission can overwrite any non-admi...

packagist

No PRs yet

Flask-Security has an Open Redirect issue

GHSA-w2j7-f3c6-g8cw MODERATE about 1 month ago

# Open Redirect in Flask-Security ## Summary `flask_security.utils.validate_redirect_url()` can allow an attacker-controlled redirect URL when su...

pypi

No PRs yet

Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

GHSA-mr8g-2mj4-pcq2 CVE-2026-49870 MODERATE about 1 month ago

### Impact `POST /two-factor` had no rate limiting, lockout, or attempt counter. An attacker with valid credentials can submit unlimited TOTP guess...

packagist

No PRs yet

phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

GHSA-8c6h-7g6x-m5x4 CVE-2026-49205 MODERATE about 1 month ago

Missing Authorization in API CategoryController — CVE-2026-24421 fixed BackupController by adding userHasPermission(PermissionType::BACKUP). The s...

packagist

No PRs yet

Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

GHSA-6f75-x745-xcpr CVE-2026-48507 HIGH about 1 month ago

### Impact The vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by ...

packagist

No PRs yet

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree

GHSA-wcmj-x466-56mm MODERATE about 1 month ago

## Summary If a symlink already exists under the `.terraform/providers` directory where a provider package needs to be installed, `tofu init` woul...

go

No PRs yet

Filament: Unauthenticated temporary file upload on auth pages

GHSA-44wp-g8f4-f4v5 CVE-2026-48500 MODERATE about 1 month ago

Any schema can contain a file upload form field, so Filament applies Livewire's `WithFileUploads` trait to the Livewire component the schema is emb...

packagist

No PRs yet

opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

GHSA-f2r5-5m7w-p5cx CVE-2026-48496 MODERATE about 1 month ago

### Summary An unprivileged process can easily trigger the `processPIDEvents` goroutine to be blocked indefinitely, preventing the goroutine from ...

go

No PRs yet

Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

GHSA-52fw-7fw2-fmv5 CVE-2026-48493 MODERATE about 1 month ago

### Impact A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission exc...

packagist

No PRs yet

Snipe-IT's selectlist visibility is too permissive

GHSA-f3c5-6cw8-fg57 CVE-2026-48492 MODERATE about 1 month ago

### Impact The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of p...

packagist

No PRs yet