Security Warnings — Source: ghsa

Playwright Capture permits access to local files and internal network resources during page capture

2026-05-14 CVE-2026-44439

mediumGitHub GHSA 2026-W20

python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

2026-05-14 CVE-2026-45370

highGitHub GHSA 2026-W20

rmcp Streamable HTTP server transport has a DNS rebinding vulnerability

2026-05-14 CVE-2026-42559

highGitHub GHSA 2026-W20

ShellHub has crash-DoS via field injection in filter and sort-by parameters

2026-05-14 CVE-2026-44425

mediumGitHub GHSA 2026-W20

ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace

2026-05-14 CVE-2026-44424

mediumGitHub GHSA 2026-W20

ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check

2026-05-14 CVE-2026-44426

mediumGitHub GHSA 2026-W20

ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data

2026-05-14 CVE-2026-44423

mediumGitHub GHSA 2026-W20

SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

2026-05-14 CVE-2026-44648

highGitHub GHSA 2026-W20

slack-go `SecretsVerifier` accepts empty signing secret without precondition

2026-05-14 GHSA-GXHX-2686-5H9G

mediumGitHub GHSA 2026-W20

SpiceDB WriteRelationships fails silently if payload is too big

2026-05-14 CVE-2025-64529

lowGitHub GHSA 2026-W20

SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results

2026-05-14 CVE-2025-65111

lowGitHub GHSA 2026-W20

Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications

2026-05-14 CVE-2026-44308

mediumGitHub GHSA 2026-W20

Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `proto` own properties

2026-05-14 GHSA-MWV9-GP5H-FRR4

lowGitHub GHSA 2026-W20

utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

2026-05-14 CVE-2026-45369

criticalGitHub GHSA 2026-W20

Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer

2026-05-14 CVE-2026-44516

highGitHub GHSA 2026-W20

Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users

2026-05-14 CVE-2026-42555

criticalGitHub GHSA 2026-W20

veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability

2026-05-14 CVE-2024-52800

lowGitHub GHSA 2026-W20

veraPDF has potential XSLT injection vulnerability when using policy files

2026-05-14 CVE-2024-28109

highGitHub GHSA 2026-W20

view_component: Preview Route Can Dispatch Inherited Helper Methods

2026-05-14 CVE-2026-44836

mediumGitHub GHSA 2026-W20

view_component: System Test Entry Point Path Check Allows Sibling Directory Escape

2026-05-14 CVE-2026-44837

mediumGitHub GHSA 2026-W20

vm2 Has a Sandbox Breakout Using Async Generator

2026-05-14 CVE-2026-45411

criticalGitHub GHSA 2026-W20

wasmtime has a panic when allocating a table exceeding the size of the host's address space

2026-05-14 CVE-2026-44216

mediumGitHub GHSA 2026-W20

@workos/authkit-session has an Open Redirect via state-derived redirect target

2026-05-13 CVE-2026-42565

mediumGitHub GHSA 2026-W20

Addressable has a Regular Expression Denial of Service in Addressable templates

2026-05-13 CVE-2026-35611

highGitHub GHSA 2026-W20

Anchor: `InterfaceAccount` allows account substitution between unexpected types

2026-05-13 GHSA-429Q-FHH4-R6HJ

highGitHub GHSA 2026-W20

Anchor: Program<'info, System> is not properly validated

2026-05-13 CVE-2026-45137

highGitHub GHSA 2026-W20

Angular Expressions - Remote Code Execution using filters

2026-05-13 CVE-2026-44643

criticalGitHub GHSA 2026-W20

Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions

2026-05-13 CVE-2026-27446

criticalGitHub GHSA 2026-W20

Apache Tomcat Improper Resource Shutdown or Release vulnerability

2026-05-13 CVE-2025-48989

highGitHub GHSA 2026-W20

Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

2026-05-13 CVE-2025-55754

lowGitHub GHSA 2026-W20

Apache Tomcat Vulnerable to Improper Resource Shutdown or Release

2026-05-13 CVE-2025-61795

lowGitHub GHSA 2026-W20

Apache Tomcat Vulnerable to Relative Path Traversal

2026-05-13 CVE-2025-55752

highGitHub GHSA 2026-W20

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

2026-05-13 CVE-2026-42576

mediumGitHub GHSA 2026-W20

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

2026-05-13 CVE-2026-42574

highGitHub GHSA 2026-W20

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

2026-05-13 CVE-2026-42575

highGitHub GHSA 2026-W20

ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases

2026-05-13 CVE-2026-44221

criticalGitHub GHSA 2026-W20

Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

2026-05-13 CVE-2026-42461

highGitHub GHSA 2026-W20

Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

2026-05-13 CVE-2026-42183

lowGitHub GHSA 2026-W20

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

2026-05-13 CVE-2026-42296

highGitHub GHSA 2026-W20

Argo has Missing Authorization in its Sync ConfigMap Provider

2026-05-13 CVE-2026-42297

highGitHub GHSA 2026-W20

Argo vulnerable to exposure of artifact repository credentials

2026-05-13 CVE-2026-42295

highGitHub GHSA 2026-W20

Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

2026-05-13 CVE-2026-42294

highGitHub GHSA 2026-W20

Astro: Server island encrypted parameters vulnerable to cross-component replay

2026-05-13 CVE-2026-45028

lowGitHub GHSA 2026-W20

auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

2026-05-13 CVE-2026-42560

criticalGitHub GHSA 2026-W20

Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect

2026-05-13 CVE-2026-44681

mediumGitHub GHSA 2026-W20

AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass

2026-05-13 CVE-2026-43874

highGitHub GHSA 2026-W20

AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass

2026-05-13 CVE-2026-43879

mediumGitHub GHSA 2026-W20

AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()

2026-05-13 CVE-2026-43884

highGitHub GHSA 2026-W20

AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

2026-05-13 CVE-2026-43885

highGitHub GHSA 2026-W20

AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content

2026-05-13 CVE-2026-43877

mediumGitHub GHSA 2026-W20

AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers

2026-05-13 CVE-2026-43876

mediumGitHub GHSA 2026-W20

AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

2026-05-13 CVE-2026-43883

mediumGitHub GHSA 2026-W20

AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover

2026-05-13 CVE-2026-43875

mediumGitHub GHSA 2026-W20

AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address

2026-05-13 CVE-2026-43880

mediumGitHub GHSA 2026-W20

AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing

2026-05-13 CVE-2026-43882

mediumGitHub GHSA 2026-W20

AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server

2026-05-13 CVE-2026-43873

highGitHub GHSA 2026-W20

AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction

2026-05-13 CVE-2026-43881

mediumGitHub GHSA 2026-W20

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

2026-05-13 CVE-2026-42205

highGitHub GHSA 2026-W20

AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass

2026-05-13 CVE-2026-42606

highGitHub GHSA 2026-W20

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

2026-05-13 CVE-2026-42605

highGitHub GHSA 2026-W20