Security Warnings — Source: ghsa

@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation

2026-05-14 GHSA-WF8Q-WVV8-P8JF

criticalGitHub GHSA 2026-W20

@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

2026-05-14 CVE-2026-45366

mediumGitHub GHSA 2026-W20

Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)

2026-05-14 CVE-2026-44504

highGitHub GHSA 2026-W20

Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

2026-05-14 CVE-2026-44437

mediumGitHub GHSA 2026-W20

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

2026-05-14 CVE-2026-42601

criticalGitHub GHSA 2026-W20

Authlib: Cross-site request forging when using cache

2026-05-14 CVE-2026-41425

mediumGitHub GHSA 2026-W20

AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion

2026-05-14 CVE-2026-32933

highGitHub GHSA 2026-W20

Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

2026-05-14 CVE-2026-44374

mediumGitHub GHSA 2026-W20

bettercap Has an Integer Coercion Error in modules/mysql_server/mysql_server.go

2026-05-14 CVE-2026-8276

lowGitHub GHSA 2026-W20

bettercap Has an Integer Coercion Error in the ippReadChunkedBody Function

2026-05-14 CVE-2026-8275

lowGitHub GHSA 2026-W20

changedetection.io project has an XXE vulnerability

2026-05-14 CVE-2026-41895

highGitHub GHSA 2026-W20

Compromise of PyTorch Lightning PyPi Package Versions

2026-05-14 CVE-2026-44484

criticalGitHub GHSA 2026-W20

CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content

2026-05-14 CVE-2026-44312

mediumGitHub GHSA 2026-W20

DevSpace UI Server WebSocket CheckOrigin does not validate source

2026-05-14 CVE-2026-42283

highGitHub GHSA 2026-W20

Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components

2026-05-14 CVE-2026-44513

highGitHub GHSA 2026-W20

Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components

2026-05-14 CVE-2026-44827

highGitHub GHSA 2026-W20

Distribution's tag deletion bypasses `storage.delete.enabled` configuration

2026-05-14 CVE-2026-41888

mediumGitHub GHSA 2026-W20

docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler

2026-05-14 CVE-2026-44520

mediumGitHub GHSA 2026-W20

etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests

2026-05-14 CVE-2026-44283

lowGitHub GHSA 2026-W20

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

2026-05-14 CVE-2026-44542

criticalGitHub GHSA 2026-W20

FlowiseAI Exposes Basic Auth Credentials via API

2026-05-14 CVE-2026-46440

highGitHub GHSA 2026-W20

FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment

2026-05-14 CVE-2026-46441

highGitHub GHSA 2026-W20

FlowiseAI Vulnerable to Credential Data Leak

2026-05-14 CVE-2026-46443

highGitHub GHSA 2026-W20

FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover

2026-05-14 CVE-2026-46475

highGitHub GHSA 2026-W20

FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

2026-05-14 CVE-2026-46442

criticalGitHub GHSA 2026-W20

FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover

2026-05-14 CVE-2026-46476

highGitHub GHSA 2026-W20

FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover

2026-05-14 CVE-2026-46477

highGitHub GHSA 2026-W20

FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover

2026-05-14 CVE-2026-46478

highGitHub GHSA 2026-W20

FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover

2026-05-14 CVE-2026-46479

highGitHub GHSA 2026-W20

FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover

2026-05-14 CVE-2026-46480

highGitHub GHSA 2026-W20

FlowiseAI: Vector Store No Permission Checks

2026-05-14 CVE-2026-46444

highGitHub GHSA 2026-W20

gittuf's policy can be rolled back to prior valid versions

2026-05-14 CVE-2026-44544

mediumGitHub GHSA 2026-W20

gix-fs: Symlink prefix-reuse allows worktree escape during checkout

2026-05-14 CVE-2026-44471

highGitHub GHSA 2026-W20

Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme

2026-05-14 CVE-2026-42597

mediumGitHub GHSA 2026-W20

Gotenberg has a Server-Side Request Forgery (SSRF) Issue

2026-05-14 CVE-2026-42591

highGitHub GHSA 2026-W20

Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move

2026-05-14 CVE-2026-40893

highGitHub GHSA 2026-W20

Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine

2026-05-14 CVE-2026-42594

highGitHub GHSA 2026-W20

Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes

2026-05-14 CVE-2026-42593

mediumGitHub GHSA 2026-W20

Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection

2026-05-14 CVE-2026-42589

criticalGitHub GHSA 2026-W20

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

2026-05-14 CVE-2026-42596

criticalGitHub GHSA 2026-W20

Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass

2026-05-14 CVE-2026-42595

highGitHub GHSA 2026-W20

Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes

2026-05-14 CVE-2026-42592

mediumGitHub GHSA 2026-W20

Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist

2026-05-14 CVE-2026-42590

highGitHub GHSA 2026-W20

Hatchet affected by cross-tenant information disclosure in `listTasksByDAGIds`

2026-05-14 CVE-2026-42572

mediumGitHub GHSA 2026-W20

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @ranfdev/deepobj

2026-05-14 CVE-2026-46509

highGitHub GHSA 2026-W20

Kata Container has CopyFile Policy Subversion via Symlinks

2026-05-14 CVE-2026-41326

highGitHub GHSA 2026-W20

katalyst-koi: Session cookies can be replayed after user logout

2026-05-14 CVE-2026-44511

highGitHub GHSA 2026-W20

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

2026-05-14 CVE-2026-44503

highGitHub GHSA 2026-W20

Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users

2026-05-14 CVE-2026-44514

mediumGitHub GHSA 2026-W20

MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint

2026-05-14 CVE-2026-42281

criticalGitHub GHSA 2026-W20

Marten has an injection vulnerability in its full-text search regConfig parameter

2026-05-14 CVE-2026-45288

criticalGitHub GHSA 2026-W20

Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

2026-05-14 CVE-2026-42334

highGitHub GHSA 2026-W20

Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException

2026-05-14 CVE-2026-44375

highGitHub GHSA 2026-W20

net-imap has quadratic complexity when reading response literals

2026-05-14 CVE-2026-42245

lowGitHub GHSA 2026-W20

net-imap vulnerable to command Injection via unvalidated Symbol inputs

2026-05-14 CVE-2026-42258

mediumGitHub GHSA 2026-W20

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

2026-05-14 CVE-2026-42256

mediumGitHub GHSA 2026-W20

net-imap vulnerable to STARTTLS stripping via invalid response timing

2026-05-14 CVE-2026-42246

highGitHub GHSA 2026-W20

Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`

2026-05-14 CVE-2026-44373

mediumGitHub GHSA 2026-W20

Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

2026-05-14 CVE-2026-44372

mediumGitHub GHSA 2026-W20

OpenBao's Namespace Deletion May Not Delete Data Properly

2026-05-14 CVE-2026-42186

lowGitHub GHSA 2026-W20