Security Warnings — Source: github

parse-ini is vulnerable to Prototype Pollution in index.js()

2026-05-12 CVE-2025-63703

criticalGitHub GitHub 2026-W20

PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes

2026-05-12 CVE-2026-41570

highGitHub GitHub 2026-W20

Postorius is vulnerable to XSS

2026-05-12 CVE-2026-44742

highGitHub GitHub 2026-W20

PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection

2026-05-12 CVE-2026-41497

criticalGitHub GitHub 2026-W20

PraisonAI has an SSRF bypass

2026-05-12 CVE-2026-44335

highGitHub GitHub 2026-W20

PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)

2026-05-12 CVE-2026-44334

highGitHub GitHub 2026-W20

PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

2026-05-12 CVE-2026-41496

highGitHub GitHub 2026-W20

protobuf.js is Vulnerable to OS Command Injection in the CLI

2026-05-12 CVE-2026-42290

highGitHub GitHub 2026-W20

protobuf.js: Code generation gadget after prototype pollution

2026-05-12 CVE-2026-44291

highGitHub GitHub 2026-W20

protobuf.js: Code injection in pbjs static output from crafted schema names

2026-05-12 CVE-2026-44295

highGitHub GitHub 2026-W20

protobuf.js: Code injection through bytes field defaults in generated toObject code

2026-05-12 CVE-2026-44293

highGitHub GitHub 2026-W20

protobuf.js: Denial of service from crafted field names in generated code

2026-05-12 CVE-2026-44294

mediumGitHub GitHub 2026-W20

protobuf.js: Denial of service through unbounded protobuf recursion

2026-05-12 CVE-2026-44289

highGitHub GitHub 2026-W20

protobuf.js: Process-wide denial of service through unsafe option paths

2026-05-12 CVE-2026-44290

highGitHub GitHub 2026-W20

protobuf.js: Prototype injection in generated message constructors

2026-05-12 CVE-2026-44292

mediumGitHub GitHub 2026-W20

protobufjs has overlong UTF-8 decoding

2026-05-12 CVE-2026-44288

mediumGitHub GitHub 2026-W20

query-parser-string is vulnerable to Prototype Pollution

2026-05-12 CVE-2025-63704

criticalGitHub GitHub 2026-W20

Remote Code Execution (RCE) via String Literal Injection into math-codegen

2026-05-12 CVE-2026-41507

criticalGitHub GitHub 2026-W20

Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL

2026-05-12 CVE-2025-67202

mediumGitHub GitHub 2026-W20

Sync-in Server has Username Enumeration via Timing Attack

2026-05-12 CVE-2026-41161

mediumGitHub GitHub 2026-W20

Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint

2026-05-12 CVE-2026-36341

mediumGitHub GitHub 2026-W20

wlc: print_html outputs API data without HTML escaping

2026-05-12 CVE-2026-42150

mediumGitHub GitHub 2026-W20

yard: Possible arbitrary path traversal and file access via yard server

2026-05-12 CVE-2026-41493

mediumGitHub GitHub 2026-W20

youtube-regex vulnerable to Regex Denial of Service

2026-05-12 CVE-2025-65122

highGitHub GitHub 2026-W20

Zebra has rk Identity Point Panic in Transaction Verification

2026-05-12 CVE-2026-41584

criticalGitHub GitHub 2026-W20

Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling

2026-05-12 CVE-2026-41583

criticalGitHub GitHub 2026-W20

Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients

2026-05-12 CVE-2026-41585

mediumGitHub GitHub 2026-W20

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

2026-05-12 CVE-2026-42275

highGitHub GitHub 2026-W20

Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content

2026-05-11 CVE-2026-45046

mediumGitHub GitHub 2026-W20

MantisBT Vulnerable to Stored XSS in File Download

2026-05-11 CVE-2026-44657

highGitHub GitHub 2026-W20