Vendor: github

Distribution's tag deletion bypasses `storage.delete.enabled` configuration

2026-05-14 CVE-2026-41888

docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler

2026-05-14 CVE-2026-44520

etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests

2026-05-14 CVE-2026-44283

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

2026-05-14 CVE-2026-44542

criticalGitHub GitHub 2026-W20

FlowiseAI Exposes Basic Auth Credentials via API

2026-05-14 CVE-2026-46440

FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment

2026-05-14 CVE-2026-46441

FlowiseAI Vulnerable to Credential Data Leak

2026-05-14 CVE-2026-46443

FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover

2026-05-14 CVE-2026-46475

FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

2026-05-14 CVE-2026-46442

criticalGitHub GitHub 2026-W20

FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover

2026-05-14 CVE-2026-46476

FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover

2026-05-14 CVE-2026-46477

FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover

2026-05-14 CVE-2026-46478

FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover

2026-05-14 CVE-2026-46479

FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover

2026-05-14 CVE-2026-46480

FlowiseAI: Vector Store No Permission Checks

2026-05-14 CVE-2026-46444

gittuf's policy can be rolled back to prior valid versions

2026-05-14 CVE-2026-44544

gix-fs: Symlink prefix-reuse allows worktree escape during checkout

2026-05-14 CVE-2026-44471

Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme

2026-05-14 CVE-2026-42597

Gotenberg has a Server-Side Request Forgery (SSRF) Issue

2026-05-14 CVE-2026-42591

Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move

2026-05-14 CVE-2026-40893

Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine

2026-05-14 CVE-2026-42594

Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes

2026-05-14 CVE-2026-42593

Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection

2026-05-14 CVE-2026-42589

criticalGitHub GitHub 2026-W20

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

2026-05-14 CVE-2026-42596

criticalGitHub GitHub 2026-W20

Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass

2026-05-14 CVE-2026-42595

Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes

2026-05-14 CVE-2026-42592

Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist

2026-05-14 CVE-2026-42590

Hatchet affected by cross-tenant information disclosure in `listTasksByDAGIds`

2026-05-14 CVE-2026-42572

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @ranfdev/deepobj

2026-05-14 CVE-2026-46509

Kata Container has CopyFile Policy Subversion via Symlinks

2026-05-14 CVE-2026-41326

katalyst-koi: Session cookies can be replayed after user logout

2026-05-14 CVE-2026-44511

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

2026-05-14 CVE-2026-44503

Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users

2026-05-14 CVE-2026-44514

MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint

2026-05-14 CVE-2026-42281

criticalGitHub GitHub 2026-W20

Marten has an injection vulnerability in its full-text search regConfig parameter

2026-05-14 CVE-2026-45288

criticalGitHub GitHub 2026-W20

Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

2026-05-14 CVE-2026-42334

Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException

2026-05-14 CVE-2026-44375

net-imap has quadratic complexity when reading response literals

2026-05-14 CVE-2026-42245

net-imap vulnerable to command Injection via unvalidated Symbol inputs

2026-05-14 CVE-2026-42258

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

2026-05-14 CVE-2026-42256

net-imap vulnerable to STARTTLS stripping via invalid response timing

2026-05-14 CVE-2026-42246

Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`

2026-05-14 CVE-2026-44373

Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

2026-05-14 CVE-2026-44372

OpenBao's Namespace Deletion May Not Delete Data Properly

2026-05-14 CVE-2026-42186

Playwright Capture permits access to local files and internal network resources during page capture

2026-05-14 CVE-2026-44439

python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

2026-05-14 CVE-2026-45370

ShellHub has crash-DoS via field injection in filter and sort-by parameters

2026-05-14 CVE-2026-44425

ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace

2026-05-14 CVE-2026-44424

ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check

2026-05-14 CVE-2026-44426

ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data

2026-05-14 CVE-2026-44423

SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

2026-05-14 CVE-2026-44648

slack-go `SecretsVerifier` accepts empty signing secret without precondition

2026-05-14 GHSA-GXHX-2686-5H9G

SpiceDB WriteRelationships fails silently if payload is too big

2026-05-14 CVE-2025-64529

SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results

2026-05-14 CVE-2025-65111

Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications

2026-05-14 CVE-2026-44308

Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `proto` own properties

2026-05-14 GHSA-MWV9-GP5H-FRR4

utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

2026-05-14 CVE-2026-45369

criticalGitHub GitHub 2026-W20

Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer

2026-05-14 CVE-2026-44516