SurrealDB: Denial of Service via deep operator chains

GHSA-jv2j-mqmw-xvv5 MODERATE about 2 months ago

An authenticated user could crash a SurrealDB server with a single query containing a long chain of operators. Such a query — for example `RETURN ...

cargo

No PRs yet

SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals

GHSA-hv6h-hc26-q48p MODERATE about 2 months ago

A record user could read field values hidden from them by field-level SELECT permissions by reaching the records through a graph-edge (`->`) or bac...

cargo

No PRs yet

SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field

GHSA-h4h3-3rfj-x6fq MODERATE about 2 months ago

A field can be hidden from a user with a field-level SELECT permission (`DEFINE FIELD code ON secret PERMISSIONS FOR select WHERE owner = $auth.id`...

cargo

No PRs yet

SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter

GHSA-cc8f-fcx3-gpjr HIGH about 2 months ago

SurrealDB's full-text search lets you define a text analyzer whose `mapper` filter loads a term-mapping file from disk (`DEFINE ANALYZER ... FILTER...

cargo

No PRs yet

SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch

GHSA-h5rg-8p7f-47g2 MODERATE about 2 months ago

SurrealDB fetches the JWKS document for a JWT or record access method using a bare `reqwest` client that follows HTTP redirects by default. The net...

cargo

No PRs yet

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

GHSA-4xgf-cpjx-pc3j MODERATE about 2 months ago

### Summary `NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a direc...

pypi

56

Dependabot PRs

Lokka: Azure Resource Manager URL path validation issue

GHSA-g2gw-q38m-vjfc HIGH about 2 months ago

Lokka versions prior to 2.1.2 constructed Azure Resource Manager request URLs using direct string concatenation with user-controlled path input. Sp...

npm

No PRs yet

@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

GHSA-h5x8-xp6m-x6q4 HIGH about 2 months ago

## Arbitrary Cloudinary API Parameter Signing in @jhb.software/payload-cloudinary-plugin ### Summary `@jhb.software/payload-cloudinary-plugin` v0...

npm

No PRs yet

LangSmith SDK TracingMiddleware: Arbitrary server-side file read

GHSA-f4xh-w4cj-qxq8 HIGH about 2 months ago

# Summary An attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can cause that server to read an ar...

pypi

No PRs yet

githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

GHSA-c3xh-98xp-6qhf HIGH about 2 months ago

### Summary A GitHub Actions workflow is vulnerable to command injection through the issue title. The workflow is triggered when an issue is open...

actions

No PRs yet

Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions

GHSA-mh64-ph39-mrc9 CVE-2026-11941 MODERATE about 2 months ago

### Impact Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The `quiche_connection...

cargo

No PRs yet

Zeep: Server-Side Request Forgery (SSRF)

GHSA-4cc2-g9w2-fhf6 MODERATE about 2 months ago

## Summary When parsing a WSDL or XSD document, python-zeep follows transitive references — xsd:import, xsd:include, wsdl:import, and lxml entity/...

pypi

No PRs yet

Anki: User scripts in iframes have access to the internal Anki API

GHSA-cw6h-ffmh-x6vh MODERATE about 2 months ago

## Summary Anki's webview-based pages communicate with the Rust backend using an internal localhost API. Anki implements measures to prevent user ...

pypi

No PRs yet

ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer

GHSA-wvrh-2f4m-924v MODERATE about 2 months ago

## Summary ChatterBot's `UbuntuCorpusTrainer.extract()` uses a predictable, home-rooted output directory (`~/ubuntu_data/ubuntu_dialogs`) with a c...

pypi

No PRs yet

OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

GHSA-h3m5-97jq-qjrf CVE-2026-57168 CRITICAL about 2 months ago

### Summary OpenRemote Manager is vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) in the bulk alarm deletion endpoint. An auth...

maven

No PRs yet

appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)

GHSA-x975-rgx4-5fh4 HIGH about 2 months ago

## Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI) ### Summary `appium-mcp`'s `createLocatorGeneratorUI` function interp...

npm

No PRs yet

EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id

GHSA-c795-2g9c-j48m HIGH about 2 months ago

EverOS versions 1.0.0 and earlier are vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint. The per-message sender_id fie...

pypi

No PRs yet

Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

GHSA-v3f4-w7r7-v3hm HIGH about 2 months ago

## Impact Uni-CLI versions before 0.225.2 exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin header...

npm

No PRs yet

stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)

GHSA-6gqw-jqv7-v88m HIGH about 2 months ago

### Summary On a multi-tenant stigmem node, a caller holding a `write` credential for **one** tenant can run a decay sweep that acts on **every** t...

pypi

No PRs yet

stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)

GHSA-xhv3-q4xx-349r HIGH about 2 months ago

### Summary On a multi-tenant stigmem node, a tenant administrator could list, read, and **admit or reject** quarantined facts belonging to **other...

pypi

No PRs yet

stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)

GHSA-x26h-xmv8-gxf7 HIGH about 2 months ago

### Summary On a multi-tenant stigmem node, RTBF (right-to-be-forgotten) tombstones were mis-scoped two ways. (1) `issue_tombstone` defaulted the t...

pypi

No PRs yet

MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

GHSA-6v7p-g79w-8964 HIGH about 2 months ago

### Impact If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. If the Unpacker is used repeatedly to unp...

pypi

24

Dependabot PRs

Gogs: XSS in .ipynb files renderer due to outdated notebookjs

GHSA-6vxv-wg6j-5qwp HIGH about 2 months ago

### Summary Gogs renders Jupyter notebook files (`.ipynb`) using [jsvine/notebookjs](https://github.com/jsvine/notebookjs), but the version is out...

go

No PRs yet

parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change

GHSA-97pr-9hgg-3p8r LOW about 2 months ago

### Impact A Parse Server LiveQuery subscriber can receive object field values they are not authorized to read when a single `save` changes both a...

npm

No PRs yet

SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`

GHSA-mrvx-jmjw-vggc HIGH about 2 months ago

## DNS-resolved Private Hostname SSRF in `web_url_read` ### Summary The `web_url_read` MCP tool in `mcp-searxng` is vulnerable to Server-Side Req...

npm

No PRs yet

SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

GHSA-xcqx-9jf5-w339 HIGH about 2 months ago

## Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read` ### Summary The `web_url_read` MCP tool in mcp-searxng enforces its 5 M...

npm

No PRs yet

Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data

GHSA-48x2-6pr9-2jjf MODERATE about 2 months ago

### Summary `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that thi...

npm

No PRs yet

Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups

GHSA-6x2m-p4xp-wg22 MODERATE about 2 months ago

### Summary `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles()` uses `statSync(full)`, ...

npm

No PRs yet

Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions

GHSA-mxjx-28vx-xjjj MODERATE about 2 months ago

## Summary `network-ai`'s `ApprovalInbox` (`lib/approval-inbox.ts`) is a shipped, exported, documented feature — *"a web-accessible approval queue...

npm

No PRs yet

Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

GHSA-jvcm-f35g-w78p MODERATE about 2 months ago

### Summary `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix...

npm

No PRs yet

Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

GHSA-2fmp-9rvw-hc96 HIGH about 2 months ago

### Summary `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` field. `EnvironmentManager.pru...

npm

No PRs yet

MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested

GHSA-9c83-rr99-vfwj CVE-2026-57442 MODERATE about 2 months ago

PathFilter's deny-list glob patterns are anchored, so `.git`, `.obsidian`, and `node_modules` were only blocked at the vault root. Nested copies in...

npm

No PRs yet

Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe

GHSA-h5jc-78hr-3pc9 LOW about 2 months ago

### Impact A stored cross-site scripting (XSS) vulnerability affected the Markdown/RichText field preview renderer in Sveltia CMS. The DOMPurify ...

npm

No PRs yet

symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest

GHSA-p9xj-fpr2-jf2q CVE-2026-55878 HIGH about 2 months ago

### Description The `ux:install` console command installs files from a recipe kit by copying paths listed in a `copy-files` map. The only guard aga...

packagist

No PRs yet

symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses

GHSA-6v8j-33hc-mv84 CVE-2026-55877 MODERATE about 2 months ago

### Description The `ux_icon()` Twig function is marked `is_safe=['html']`, so Twig never escapes its output. `Icon::toHtml()` inlines the SVG sou...

packagist

No PRs yet

SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected

GHSA-4vrg-r928-h5vv CVE-2026-55866 LOW about 2 months ago

### Impact Under concurrency, `CheckPermission` and `CheckBulkPermissions` can return `PERMISSIONSHIP_HAS_PERMISSION` for a (resource, permission,...

go

No PRs yet

OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

GHSA-8w8f-r2xv-4q4j CVE-2026-55776 MODERATE about 2 months ago

On OpenBao 2.5.4 and 2.5.2(and likely earlier versions also), an authenticated caller with write access to `transit/keys/*` can crash the OpenBao s...

go

No PRs yet

OpenBao's System Backend allows Unauthorized Management of the containing Namespace

GHSA-mwr2-wmgp-crj6 CVE-2026-55775 LOW about 2 months ago

### Summary A user that is granted namespace management (`/sys/namespaces`) capabilities within a non-root namespace ("the victim namespace") can ...

go

No PRs yet

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

GHSA-c36x-h252-g9x2 CVE-2026-55774 LOW about 2 months ago

### Summary OpenBao users with access to the `sys/leases/revoke/:lease_id` endpoint in any namespace can revoke leases in any other namespace as l...

go

No PRs yet

OpenBao: LDAPi ldaputil (wrong escape func)

GHSA-6mwx-4547-5vc9 CVE-2026-55770 MODERATE about 2 months ago

## 1. Description ### Component `sdk/helper/ldaputil/client.go` — the shared LDAP utility library used by both the LDAP authentication backend an...

go

No PRs yet

StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled

GHSA-5c7p-g73q-rpg5 CVE-2026-55692 HIGH about 2 months ago

### Summary With $wgEmbedVideoRequireConsent enabled (the default), the urls for videos are stored in a json-ified data attribute`data-mw-iframecon...

packagist

No PRs yet

Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure

GHSA-wwf9-7jrc-rv4q CVE-2026-55650 MODERATE about 2 months ago

## Summary A Stored Cross-Site Scripting (XSS) issue previously existed in the Text Widget in Board of Outerbase Studio where unsanitized HTML cou...

npm

No PRs yet

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

GHSA-ccv6-r384-xp75 CVE-2026-55447 CRITICAL about 2 months ago

### Summary All components based on `BaseFileComponent` are vulnerable to the following vulnerability: 1. Docling (`DoclingInlineComponent`) 2. Doc...

pypi

No PRs yet

Langflow: Unauthenticated DoS through multipart form boundary file upload

GHSA-qwqc-p3q8-wcg9 CVE-2026-55446 HIGH about 2 months ago

### Summary An attacker can send a `/api/v1/files/upload/` request without any authentication token/cookies and abuse a very long multipart form bo...

pypi

No PRs yet

Langflow: Logout button does not clear session

GHSA-7hw8-6q6r-4276 CVE-2026-55423 MODERATE about 2 months ago

### Summary The logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. ### Details No...

pypi

No PRs yet

Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

GHSA-qrpv-q767-xqq2 CVE-2026-55255 HIGH about 2 months ago

## Summary Insecure Direct Object Reference (IDOR) vulnerability in `/api/v1/responses` endpoint allows an authenticated attacker to execute any f...

pypi

No PRs yet

py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()

GHSA-h4gh-22qq-72r7 CVE-2026-55206 MODERATE about 2 months ago

### Summary PackInfo._read() uses an O(n^2) cumulative sum pattern where numstreams is read directly from the archive header. A crafted .7z ar...

pypi

No PRs yet

py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size

GHSA-gjrg-mpp7-g774 CVE-2026-55195 MODERATE about 2 months ago

py7zr's `Worker.decompress()` extracts archive entries without tracking total decompressed size. A crafted `.7z` file can exhaust disk or memory be...

pypi

No PRs yet

Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms

GHSA-w4mc-hhc6-xp28 CVE-2026-55187 MODERATE about 2 months ago

## Summary The remediation shipped in mailpit v1.29.2 for [GHSA-mpf7-p9x7-96r3](https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p...

go

No PRs yet

Open Redirect Bypass in miniflux-v2

GHSA-m999-j542-5w3r CVE-2026-55185 MODERATE about 2 months ago

### Summary The URL restrictions in `miniflux-v2` can be bypassed by attackers, leading to an open redirect vulnerability. ### Details Normally, ...

go

No PRs yet