Snipe-IT Vulnerable to User Account Escalation via CSV Import

GHSA-p68w-rgmg-3c2v CVE-2026-49976 MODERATE about 1 month ago

### Impact The CSV user import in update mode bypasses user-edit authorization. A user with only the `import` permission can overwrite any non-admi...

packagist

No PRs yet

Flask-Security has an Open Redirect issue

GHSA-w2j7-f3c6-g8cw MODERATE about 1 month ago

# Open Redirect in Flask-Security ## Summary `flask_security.utils.validate_redirect_url()` can allow an attacker-controlled redirect URL when su...

pypi

No PRs yet

Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

GHSA-mr8g-2mj4-pcq2 CVE-2026-49870 MODERATE about 1 month ago

### Impact `POST /two-factor` had no rate limiting, lockout, or attempt counter. An attacker with valid credentials can submit unlimited TOTP guess...

packagist

No PRs yet

phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

GHSA-8c6h-7g6x-m5x4 CVE-2026-49205 MODERATE about 1 month ago

Missing Authorization in API CategoryController — CVE-2026-24421 fixed BackupController by adding userHasPermission(PermissionType::BACKUP). The s...

packagist

No PRs yet

Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

GHSA-6f75-x745-xcpr CVE-2026-48507 HIGH about 1 month ago

### Impact The vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by ...

packagist

No PRs yet

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree

GHSA-wcmj-x466-56mm MODERATE about 1 month ago

## Summary If a symlink already exists under the `.terraform/providers` directory where a provider package needs to be installed, `tofu init` woul...

go

No PRs yet

Filament: Unauthenticated temporary file upload on auth pages

GHSA-44wp-g8f4-f4v5 CVE-2026-48500 MODERATE about 1 month ago

Any schema can contain a file upload form field, so Filament applies Livewire's `WithFileUploads` trait to the Livewire component the schema is emb...

packagist

No PRs yet

opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

GHSA-f2r5-5m7w-p5cx CVE-2026-48496 MODERATE about 1 month ago

### Summary An unprivileged process can easily trigger the `processPIDEvents` goroutine to be blocked indefinitely, preventing the goroutine from ...

go

No PRs yet

Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

GHSA-52fw-7fw2-fmv5 CVE-2026-48493 MODERATE about 1 month ago

### Impact A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission exc...

packagist

No PRs yet

Snipe-IT's selectlist visibility is too permissive

GHSA-f3c5-6cw8-fg57 CVE-2026-48492 MODERATE about 1 month ago

### Impact The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of p...

packagist

No PRs yet

phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

GHSA-58fg-62fg-3fcj CVE-2026-48488 LOW about 1 month ago

### Summary Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks sinc...

packagist

No PRs yet

OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation

GHSA-r6fj-869h-4f6q CVE-2026-48480 MODERATE about 1 month ago

The codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the...

maven

No PRs yet

Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS

GHSA-3fc8-8hp6-6jr4 CVE-2026-48167 MODERATE about 1 month ago

The `ImageColumn` and `ImageEntry` components render raw database values without escaping HTML. Where the data passed to these components isn't val...

packagist

No PRs yet

Filament: Timing-based user enumeration on login page

GHSA-5w46-g9pq-wh6f CVE-2026-48166 MODERATE about 1 month ago

The login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is li...

packagist

No PRs yet

Slim has Reflected XSS in the HtmlErrorRenderer

GHSA-53h4-8rc4-f539 CVE-2026-48157 MODERATE about 1 month ago

### Impact If an application uses `HttpException::setTitle()` and/or `setDescription()` to include untrusted/request-derived data in the error tit...

packagist

1

Dependabot PRs

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

GHSA-jc3j-x6pg-4hmv CVE-2026-48126 HIGH about 1 month ago

### Summary When algernon is started with `--domain` (or `--letsencrypt`, which silently turns on `--domain` at `engine/flags.go:372`), the reques...

go

No PRs yet

jackson-databind has @JsonView bypass for setterless creator properties

GHSA-5hh8-q8hv-fr38 CVE-2026-54517 MODERATE about 1 month ago

## Summary In `BeanDeserializer._deserializeUsingPropertyBased`, the active-view (`@JsonView`) filter was applied only to creator properties; the r...

maven

No PRs yet

jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields

GHSA-9fxm-vc8v-hj55 CVE-2026-54516 MODERATE about 1 month ago

## Summary `POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty("renamed")` on the getter and `@JsonIgnore` on the s...

maven

No PRs yet

jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

GHSA-5jmj-h7xm-6q6v CVE-2026-54515 MODERATE about 1 month ago

## Summary In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`,...

maven

No PRs yet

jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

GHSA-hgj6-7826-r7m5 CVE-2026-54514 MODERATE about 1 month ago

## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name reso...

maven

No PRs yet

jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

GHSA-rmj7-2vxq-3g9f CVE-2026-54513 HIGH about 1 month ago

## Summary `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on `clazz.isArray()`, without valid...

maven

No PRs yet

jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation

GHSA-j3rv-43j4-c7qm CVE-2026-54512 HIGH about 1 month ago

`jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing...

maven

No PRs yet

jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

GHSA-3wrr-7qpf-2prh CVE-2026-50193 MODERATE about 1 month ago

### Impact Potential Denial-of-Service when attacker sends deeply nested JSON if (and only if) service: 1. Reads deeply nested (1000s of levels) ...

maven

No PRs yet

jackson-databind has a @JsonView bypass for unwrapped creator parameters

GHSA-rcqc-6cw3-h962 CVE-2026-54518 MODERATE about 1 month ago

## Summary `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` replays buffered JSON into creator parameters but never consults `prop.vi...

maven

No PRs yet

AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

GHSA-7cqp-7cfv-6c3q MODERATE about 1 month ago

### Summary The Meet plugin stores the raw HTTP `User-Agent` header of every meeting participant and later renders it without output encoding in t...

packagist

No PRs yet

motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal

GHSA-phv5-334h-mxcw CRITICAL about 1 month ago

# Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal ### Summary Myself and others have reported several RC...

pypi

No PRs yet

motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)

GHSA-qxvg-h7q2-hcxh CRITICAL about 1 month ago

## Summary A multi‑stage chain in motionEye leads to remote code execution. The chain combines: 1. **Arbitrary file read (LFI)** via the picture d...

pypi

No PRs yet

motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution

GHSA-j67x-q29f-qcvv CVE-2026-55863 MODERATE about 1 month ago

## Summary The `ActionHandler.post()` method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera...

pypi

No PRs yet

motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read

GHSA-rw9q-97r9-8gvh CVE-2026-55488 HIGH about 1 month ago

### Summary mEye contains an absolute path traversal vulnerability in multiple media file handlers that allows an attacker to read arbitrary files...

pypi

No PRs yet

Mise's local credential_command executes untrusted config

GHSA-29hf-rm4x-xxph CVE-2026-55448 MODERATE about 1 month ago

### Summary `mise` loads `github.credential_command` from local project config before any trust decision, then executes that value with `sh -c` wh...

cargo

No PRs yet

Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository

GHSA-77g9-363w-rccq CVE-2026-55441 HIGH about 1 month ago

### Summary mise's trust feature gates config files (`mise.toml`, `.tool-versions`) through `trust_check`, but task-include files are loaded on a ...

cargo

No PRs yet

Private action arguments can be set by user input in Ash

EEF-CVE-2026-55736 GHSA-f4hc-ppw9-4hhw CVE-2026-55736 MEDIUM about 1 month ago

## Summary Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set th...

hex

No PRs yet

mise HTTP backend uses raw version path for install symlink destination

GHSA-f94h-j2qg-fxw3 CVE-2026-54557 MODERATE about 1 month ago

## Summary The mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool ...

cargo

No PRs yet

OctoPrint has possible file exfiltration via query parameters on upload endpoints

GHSA-j4h9-pm27-4rfw CVE-2026-54134 HIGH about 1 month ago

### Impact OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with ...

pypi

No PRs yet

Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration

GHSA-3vwc-qwhc-3mj7 CVE-2026-53925 HIGH about 1 month ago

### Summary The `secure_popen()` function in `glances/secure.py` interprets `>` (file redirection), `|` (pipe), and `&&` (command chaining) operat...

pypi

No PRs yet

Budibase has nonymous NoSQL operator injection via published-app query templates

GHSA-8qv3-p479-cj62 CVE-2026-54350 CRITICAL about 1 month ago

## Summary `enrichContext` at `packages/server/src/sdk/workspace/queries/queries.ts:121-138` substitutes parameter values into the raw JSON body o...

npm

No PRs yet

AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink

GHSA-wc3f-xc32-435f CVE-2026-55173 HIGH about 1 month ago

### Summary The fix for CVE-2026-33482 (GHSA-pmj8-r2j7-xg6c) is incomplete. That advisory reported that `sanitizeFFmpegCommand()` (`plugin/API/sta...

packagist

No PRs yet

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

GHSA-3w28-36p9-w929 CVE-2026-52816 MODERATE about 2 months ago

## Summary The Jupyter Notebook (ipynb) sanitizer endpoint at `POST /-/api/sanitize_ipynb` allows arbitrary `data:` URIs without proper restrictio...

go

No PRs yet

OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet

GHSA-r9pv-5rpp-vm8g CVE-2026-45049 HIGH about 2 months ago

## Summary **Description** An Information Exposure Through Sent Data (CWE-201) issue in OpenAM's Cross-Domain Single Sign-On (CDSSO) servlet allo...

maven

No PRs yet

OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

GHSA-vvhj-w2jq-263q CVE-2026-45048 HIGH about 2 months ago

## Summary Description An insufficient authorization (CWE-285) and information exposure (CWE-200) issue in OpenAM's session management endpoint a...

maven

No PRs yet

OctoPrint has XSS in its Suppressed Command Notifications

GHSA-p6qx-ghxm-389h CVE-2026-35163 MODERATE about 2 months ago

### Impact OctoPrint versions up to and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 are affected by a vulnerability that allows injection of...

pypi

No PRs yet

Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API

GHSA-744x-3838-5r56 CVE-2026-52815 MODERATE about 2 months ago

## Summary Gogs has an unauthenticated information disclosure vulnerability. The `GET /api/v1/orgs/:orgname/teams` endpoint at `internal/route/api...

go

No PRs yet

Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)

GHSA-xp79-5mx3-jx52 CVE-2026-52814 MODERATE about 2 months ago

The Gogs built-in Go SSH server is vulnerable to an unauthenticated, asymmetric Denial of Service (DoS) attack. The application accepts inbound TCP...

go

No PRs yet

Gogs has Path Traversal in organization name that results in RCE through Git hooks

GHSA-c39w-43gm-34h5 CVE-2026-52813 CRITICAL about 2 months ago

### Summary Organization names containing path traversal sequences (`../`) are accepted by Gogs, and repositories under them are written to paths ...

go

No PRs yet

Gogs: LFS dedupe path leaks private repo content across tenants

GHSA-6p9m-q3jp-47h4 CVE-2026-52812 HIGH about 2 months ago

Summary Git LFS storage is content-addressed by OID alone (`<LFS-root>/<oid[0]>/<oid[1]>/<oid>`) but per-repo authorization lives in the `lfs_obje...

go

No PRs yet

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

GHSA-89mr-xqfv-758m CVE-2026-52811 CRITICAL about 2 months ago

Summary `(*Repository).UploadRepoFiles` checks for symlinks only on the **leaf** of the upload target (`osx.IsSymlink(targetPath)`). The siblings ...

go

No PRs yet

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion

GHSA-wmfg-5p4h-5fw3 CVE-2026-52810 HIGH about 2 months ago

### Summary Git smart HTTP authorizes `POST …/git-receive-pack` using the client-supplied service query string (so `?service=git-upload-pack` is e...

go

No PRs yet

Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES

GHSA-5c3f-6486-3g7g CVE-2026-52809 MODERATE about 2 months ago

## Summary Password-reset tokens are generated using `conf.Auth.ActivateCodeLives` (the account-activation lifetime), not `conf.Auth.ResetPassword...

go

No PRs yet

Gogs's write-level collaborators can mutate admin-only repository settings via API

GHSA-268j-37xf-pp52 CVE-2026-52808 HIGH about 2 months ago

## Summary Three API endpoints — `PATCH /api/v1/repos/:owner/:repo/issue-tracker`, `PATCH /api/v1/repos/:owner/:repo/wiki`, and `POST /api/v1/repo...

go

No PRs yet

Gogs has DOM-based XSS via Milestone Name on New Issue Page

GHSA-vcm5-gvmp-78mp CVE-2026-52807 MODERATE about 2 months ago

### Summary The fix for GHSA-vgjm-2cpf-4g7c (DOM-based XSS via milestone selection) was only applied to `templates/repo/issue/view_content.tmpl` bu...

go

No PRs yet