http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments

GHSA-c7jm-38gq-h67h MODERATE about 2 months ago

### Impact `ServerFilters.DigestAuth` and the underlying `DigestAuthProvider` both defaulted their `nonceVerifier` parameter to `{ true }` — i.e. ...

maven

No PRs yet

http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default

GHSA-pr33-38xx-6r26 MODERATE about 2 months ago

### Impact The previous `BasicCookieStorage` did not enforce RFC 6265 scoping rules around cookie domain, path, and `Secure` attribute. A client u...

maven

No PRs yet

http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`

GHSA-m4w9-hjfw-vwj4 HIGH about 2 months ago

### Impact The `HmacSha256` class contained two functions: - `hash(payload)` — a plain unkeyed SHA-256 digest. The `Hmac` prefix in the class name...

maven

No PRs yet

http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`

GHSA-jrpc-7vxp-69p6 MODERATE about 2 months ago

### Impact `reverseProxy()` and `reverseProxyRouting()` matched configured vhosts by substring on the `Host` header (`Contains` matcher) by defaul...

maven

No PRs yet

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

GHSA-4mr2-fg2p-w63c CVE-2026-54762 MODERATE about 2 months ago

## Summary There is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When ...

go

No PRs yet

Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering

GHSA-gx93-m64w-5m6h CVE-2026-55847 MODERATE about 2 months ago

## Summary The `ansi.js` Handlebars helper in allure-generator passes user-controlled `statusMessage` and `statusTrace` values from test result fi...

maven

No PRs yet

Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read

GHSA-82cg-3hv7-74gc CVE-2026-55846 MODERATE about 2 months ago

## Summary The built-in HTTP server started by `allure serve` and `allure open` is vulnerable to path traversal. The server resolves request URI p...

maven

No PRs yet

VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files

GHSA-rpj2-4hq8-938g HIGH about 2 months ago

### Summary vcrpy deserializes YAML cassette files with PyYAML's object-constructing loader (`yaml.CLoader` / `yaml.Loader`) instead of the safe l...

pypi

3

Dependabot PRs

dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

GHSA-jr33-mw75-7j8f CVE-2026-55837 MODERATE about 2 months ago

## Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens ### Summary The local OAuth helper FastAPI server bundled with `dbt-mcp` expo...

pypi

No PRs yet

Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser

GHSA-p5wc-9w9r-m232 HIGH about 2 months ago

## XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser ### Summary `ultimate-sitemap-parser` version 1.8.0 and earlier parse attacker-c...

pypi

No PRs yet

Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit

GHSA-8823-qg2x-pv9f HIGH about 2 months ago

## Gzip Decompression Bomb Bypasses Sitemap Size Limit ### Summary `ultimate-sitemap-parser` enforces a 100 MiB size limit on sitemap responses, ...

pypi

No PRs yet

go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)

GHSA-f9m7-vc86-p6jj CVE-2026-55828 MODERATE about 2 months ago

### Impact The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractTar routine. The library's p...

go

No PRs yet

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

GHSA-g5qx-h5f3-mp2f CVE-2026-55660 HIGH about 2 months ago

TinaCMS registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe Grap...

npm

No PRs yet

Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

GHSA-h5gm-x9wr-vhcm CVE-2026-55795 MODERATE about 2 months ago

### Summary The CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET parameter is explicitly provided. ...

packagist

No PRs yet

Craft Commerce: Partial Payment Amount Without Lower Bound Validation

GHSA-78vr-q6cf-c7p6 MODERATE about 2 months ago

### Summary The `Order::setPaymentAmount()` method accepts any float value without enforcing a minimum positive amount. The PaymentsController cas...

packagist

No PRs yet

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

GHSA-c55v-343g-5xff CVE-2026-55791 CRITICAL about 2 months ago

**1. Overview** Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the `/actions/app/resourc...

packagist

No PRs yet

@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

GHSA-4936-9hrh-qqpw CVE-2026-54074 HIGH about 2 months ago

## Description ### Summary `@tinacms/cli` contains a Remote Code Execution vulnerability in its Forestry-to-Tina migration command. The internal ...

npm

No PRs yet

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

GHSA-7h5p-637f-jfr7 CVE-2026-55691 HIGH about 2 months ago

### Summary The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote to escape the class and then...

packagist

No PRs yet

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text

GHSA-c29q-5xm7-5p62 CVE-2026-55690 HIGH about 2 months ago

### Summary When passing an unknown service name to embedvideo, an error message is rendered containing the invalid service name. The service name ...

packagist

No PRs yet

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

GHSA-fcw4-wwqm-m8cf CVE-2026-11769 MODERATE about 2 months ago

We have released version 5.24.0 of the Grafana Operator. This patch includes a MODERATE severity security fix for a path traversal/privilege escala...

go

No PRs yet

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

GHSA-wfqx-gjrf-g28r CRITICAL about 2 months ago

## Summary Crossplane allows package signature verification to be configured via the `ImageConfig` mechanism. When enabled, the package manager us...

go

No PRs yet

flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

GHSA-hp36-v28f-w3r4 CVE-2026-55091 HIGH about 2 months ago

### Summary `convert()` builds the nested tree by using each flat record's `id` and `parent` field values directly as object keys, with no guard ...

npm

No PRs yet

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument

GHSA-v75r-vx73-82pj CVE-2026-55849 HIGH about 2 months ago

## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option whi...

npm

No PRs yet

Blocky DNSSEC validation bypass and validation-cache scope pollution

GHSA-x845-2f78-7v36 HIGH about 2 months ago

## Summary Blocky accepts and caches forged DNS answers while `dnssec.validate: true` is enabled. The issue has two related exploit paths: 1. **B...

go

No PRs yet

UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

GHSA-3j69-69wj-xqx2 CVE-2026-54911 MODERATE about 2 months ago

### Summary `ujson.dumps()` (or `ujson.dump()` or `ujson.encode()`) have a `reject_bytes=False` option. When set, they may accept malformed or trun...

pypi

No PRs yet

Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption

GHSA-6wx8-w4f5-wwcr CVE-2026-54906 LOW about 2 months ago

### Summary `Concurrent::ReadWriteLock#release_write_lock` does not verify that the calling thread acquired the write lock. Any thread with access ...

rubygems

19

Dependabot PRs

Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity

GHSA-wv3x-4vxv-whpp CVE-2026-54905 LOW about 2 months ago

### Summary `Concurrent::ReentrantReadWriteLock` can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock...

rubygems

19

Dependabot PRs

Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`

GHSA-h8w8-99g7-qmvj CVE-2026-54904 HIGH about 2 months ago

### Summary `Concurrent::AtomicReference#update` can enter a permanent busy retry loop when the current value is `Float::NAN`. The issue is caused...

rubygems

19

Dependabot PRs

Oj: Integer Overflow in Oj.load 2GB String Handling

GHSA-475m-ph3x-64gp CVE-2026-54903 HIGH about 2 months ago

### Summary `Oj.load` is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in `buf_append_string` (`b...

rubygems

No PRs yet

Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback

GHSA-m578-w5vf-rfcm CVE-2026-54902 HIGH about 2 months ago

### Summary `Oj::Parser` in SAJ mode does not protect cached object keys (≥ 35 bytes) from garbage collection. A Ruby callback that triggers GC in...

rubygems

No PRs yet

Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking

GHSA-vwm4-62gf-x745 CVE-2026-54901 HIGH about 2 months ago

### Summary `Oj::Parser` in usual mode does not mark `array_class` and `hash_class` references during garbage collection. If GC runs after the cla...

rubygems

No PRs yet

Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling

GHSA-9cv6-qcjw-4grx CVE-2026-54900 HIGH about 2 months ago

### Summary `Oj::Parser#parse` in usual mode with `create_id` enabled is vulnerable to heap corruption via a negative-size `memcpy`. When a JSON o...

rubygems

No PRs yet

Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)

GHSA-v52w-28xh-v562 HIGH about 2 months ago

Kozou compiles a PostgreSQL schema into an Admin UI, a REST API, and an MCP server. Several hardening gaps in the bundled HTTP surfaces and the sca...

npm

No PRs yet

CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

GHSA-2288-8h3r-cqgg CVE-2026-54784 HIGH about 2 months ago

### Impact When the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the ...

nuget

No PRs yet

CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

GHSA-gqv6-pwcg-87r8 CVE-2026-54783 HIGH about 2 months ago

### Impact The attacker, with one captured signed SOAP envelope from a victim and no other privileges, can invoke arbitrary operations on the servi...

nuget

No PRs yet

CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

GHSA-xjr9-gg9q-jx3v CVE-2026-54782 CRITICAL about 2 months ago

### Impact Full impersonation of any principal the trusted STS could have issued an assertion for — including administrative principals when the re...

nuget

No PRs yet

CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced

GHSA-48pq-2xq3-c2m4 CVE-2026-54781 HIGH about 2 months ago

### Impact The relying application is given a ClaimsPrincipal for a subject whose authority over the assertion the sender never proved. There are t...

nuget

No PRs yet

CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass

GHSA-4v55-cpmv-3vcm CVE-2026-54780 LOW about 2 months ago

### Impact CoreWCF’s WS-Security 1.0 receive pipeline validates the `SignatureMethod` of an incoming `ds:SignedInfo` against the configured `Securi...

nuget

No PRs yet

CoreWCF: SAML token replay protection is inoperative

GHSA-9jr3-rj99-8jq3 CVE-2026-54779 MODERATE about 2 months ago

### Impact When enabling DetectReplayedTokens, a token can be replayed and will be detected despite it being reused. ### Patches Fixed in CoreWCF ...

nuget

No PRs yet

CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution

GHSA-q6v9-43v5-jv9q CVE-2026-54778 MODERATE about 2 months ago

### Impact Race condition in POSIX peer identity resolution may attribute one connection’s identity to another (getpwuid/getgrgid non-reentrant) an...

nuget

No PRs yet

CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance

GHSA-6jj2-4q5c-x8g6 CVE-2026-54777 MODERATE about 2 months ago

### Impact CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic...

nuget

No PRs yet

CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade

GHSA-wjpq-6766-7f5j CVE-2026-54776 MODERATE about 2 months ago

### Impact A CoreWCF service hosted on Unix Domain Sockets with the PosixIdentity client credential type (UnixDomainSocketBinding with Security.Mod...

nuget

No PRs yet

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

GHSA-m744-jhq9-ppw6 CVE-2026-54775 MODERATE about 2 months ago

### Impact A CoreWCF service is running and listening on a Kafka topic receiving a null-value record will stop processing new records from that top...

nuget

No PRs yet

CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

GHSA-rpj7-hr7h-w6p9 CVE-2026-54774 HIGH about 2 months ago

### Impact When a service is configured to validate SAML tokens using a method other than X.509 certificate signing, the final signature verificati...

nuget

No PRs yet

CoreWCF: WS-Security signature substitution via document-wide Signature lookup

GHSA-jc6x-rj79-w4mx CVE-2026-54773 MODERATE about 2 months ago

### Impact An unauthenticated remote attacker who can place a SOAP header lexically before `wsse:Security` can embed a `ds:Signature` of their choo...

nuget

No PRs yet

CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

GHSA-p86g-xrr2-pf7c CVE-2026-54772 HIGH about 2 months ago

### Impact An unauthenticated remote attacker can pin one server thread‑pool worker at 100 % CPU per connection. With a few connections, the CPU us...

nuget

No PRs yet

Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

GHSA-vq2f-vcc9-j8mv CVE-2026-55865 MODERATE about 2 months ago

### Impact Given a malformed `{% case %}` tag without associated `{% when %}` or `{% else %}` block, and no terminating `{% endcase %}` tag, Python...

pypi

No PRs yet

Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation

GHSA-q2gm-54r6-8fwm CVE-2026-54898 HIGH about 2 months ago

### Summary `Oj::Parser#parse` is vulnerable to a heap use-after-free when a SAJ/SAJ2 callback mutates the input JSON string during parsing. The C...

rubygems

No PRs yet

Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close

GHSA-9ppp-w3g4-fh4q CVE-2026-54897 HIGH about 2 months ago

### Summary `Oj::Doc` iterators (`each_value`, `each_child`, `each_leaf`) are vulnerable to a heap use-after-free. When a Ruby block yielded durin...

rubygems

No PRs yet

Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent

GHSA-35w3-pjm6-wj95 CVE-2026-54896 HIGH about 2 months ago

### Summary `Oj.dump` in object mode is vulnerable to a heap buffer overflow when serializing Exception objects with a large `:indent` value. The ...

rubygems

No PRs yet