Security Warnings — Vendor: github

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

2026-05-19 CVE-2026-45737

mediumGitHub GitHub 2026-W21

Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

2026-05-19 CVE-2026-45738

highGitHub GitHub 2026-W21

auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs

2026-05-19 GHSA-HV85-774V-26FG

highGitHub GitHub 2026-W21

AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`

2026-05-19 CVE-2026-46337

mediumGitHub GitHub 2026-W21

Bandit: Unauthenticated DoS via chunked request trailers in Bandit HTTP/1 decoder

2026-05-19 CVE-2026-39806

highGitHub GitHub 2026-W21

Bandit: Unauthenticated one-shot DoS via `Transfer-Encoding: chunked`

2026-05-19 CVE-2026-39803

highGitHub GitHub 2026-W21

Bouncy Castle has a vulnerability in program files gcm128w, gcm512w

2026-05-19 CVE-2026-8149

mediumGitHub GitHub 2026-W21

Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour

2026-05-19 CVE-2026-46424

mediumGitHub GitHub 2026-W21

Budibase: Unrestricted Upload of File with Dangerous Type

2026-05-19 CVE-2026-46426

highGitHub GitHub 2026-W21

Caddy CVE-2026-30852 Fix Bypass

2026-05-19 GHSA-WWHQ-W58M-W29C

mediumGitHub GitHub 2026-W21

Caddy Defender trusted proxy client IP bypass

2026-05-19 CVE-2026-46415

highGitHub GitHub 2026-W21

Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

2026-05-19 CVE-2026-45692

mediumGitHub GitHub 2026-W21

Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching

2026-05-19 GHSA-GX7W-56W6-G48X

mediumGitHub GitHub 2026-W21

CamoFox MCP: Unauthenticated HTTP MCP browser-control surface

2026-05-19 GHSA-7HGR-7H44-33W2

highGitHub GitHub 2026-W21

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

2026-05-19 CVE-2026-46354

criticalGitHub GitHub 2026-W21

Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint

2026-05-19 CVE-2026-45796

mediumGitHub GitHub 2026-W21

Cowboy: Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy

2026-05-19 CVE-2026-8466

highGitHub GitHub 2026-W21

cowlib: Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

2026-05-19 CVE-2026-43970

highGitHub GitHub 2026-W21

Cross-site request forgery in Django

2026-05-19 CVE-2011-0696

highGitHub GitHub 2026-W21

Cross-site scripting in django

2026-05-19 CVE-2011-0697

mediumGitHub GitHub 2026-W21

Cross-site Scripting in Ericsson CodeChecker

2026-05-19 CVE-2021-44217

mediumGitHub GitHub 2026-W21

Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal

2026-05-19 CVE-2026-46378

highGitHub GitHub 2026-W21

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

2026-05-19 CVE-2026-46377

highGitHub GitHub 2026-W21

Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`

2026-05-19 GHSA-M9P2-FXP5-V3FP

mediumGitHub GitHub 2026-W21

Diesel: Possible unaligned data access for implementations of `SqliteAggregate`

2026-05-19 GHSA-Q8X8-JRHJ-FH9P

mediumGitHub GitHub 2026-W21

Envoy AI Proxy - MCP Message Smuggling Vulnerability

2026-05-19 GHSA-4GPH-2HHR-5MWG

mediumGitHub GitHub 2026-W21

fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

2026-05-19 CVE-2026-45581

mediumGitHub GitHub 2026-W21

FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation

2026-05-19 CVE-2026-27964

lowGitHub GitHub 2026-W21

FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

2026-05-19 CVE-2026-27892

mediumGitHub GitHub 2026-W21

Fava time and filter parameters vulnerable to reflected Cross-site Scripting

2026-05-19 CVE-2022-2514

mediumGitHub GitHub 2026-W21

FileBrowser Quantum: unauthenticated user share share info

2026-05-19 CVE-2026-46410

highGitHub GitHub 2026-W21

Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default

2026-05-19 CVE-2024-6221

highGitHub GitHub 2026-W21

FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

2026-05-19 CVE-2026-45802

mediumGitHub GitHub 2026-W21

Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

2026-05-19 CVE-2026-45793

highGitHub GitHub 2026-W21

GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

2026-05-19 CVE-2026-45803

lowGitHub GitHub 2026-W21

Gradio Path Traversal vulnerability

2026-05-19 CVE-2024-0964

highGitHub GitHub 2026-W21

HashiCorp Nomad vulnerable to a path traversal

2026-05-19 CVE-2026-7474

highGitHub GitHub 2026-W21

HashiCorp Nomad vulnerable to symlink attack

2026-05-19 CVE-2026-6959

mediumGitHub GitHub 2026-W21

HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack

2026-05-19 CVE-2026-8052

mediumGitHub GitHub 2026-W21

HAX CMS: Denial of Service using Malicious Import Request

2026-05-19 CVE-2026-46357

mediumGitHub GitHub 2026-W21

HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

2026-05-19 CVE-2026-46496

mediumGitHub GitHub 2026-W21

HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

2026-05-19 CVE-2026-46391

highGitHub GitHub 2026-W21

HAXcms createSite SSRF Enables Arbitrary File Read

2026-05-19 CVE-2026-46393

highGitHub GitHub 2026-W21

HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

2026-05-19 CVE-2026-46511

highGitHub GitHub 2026-W21

HAXcms: Private Key Disclosure via Broken HMAC Implementation

2026-05-19 CVE-2026-46395

criticalGitHub GitHub 2026-W21

Improper date handling in Django

2026-05-19 CVE-2010-4535

mediumGitHub GitHub 2026-W21

Improper query string handling in Django

2026-05-19 CVE-2010-4534

highGitHub GitHub 2026-W21

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

2026-05-19 CVE-2026-45409

mediumGitHub GitHub 2026-W21

Jupyter Server open redirect vulnerability

2026-05-19 CVE-2020-26275

mediumGitHub GitHub 2026-W21

Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation

2026-05-19 GHSA-M23H-6MWM-39M8

mediumGitHub GitHub 2026-W21

Kong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpoint

2026-05-19 GHSA-3278-C88V-XRH4

mediumGitHub GitHub 2026-W21

Kopia: RCE via SSH ProxyCommand Injection

2026-05-19 CVE-2026-45695

criticalGitHub GitHub 2026-W21

libcrux-ml-dsa: Signature Verification on AVX2 Platforms Mishandles Edge Case

2026-05-19 GHSA-FHVH-VW7H-9XF3

highGitHub GitHub 2026-W21

libcrux: Potential Panic on Overlong Ciphertext Buffer

2026-05-19 GHSA-HC3C-63HC-2R9F

highGitHub GitHub 2026-W21

Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer

2026-05-19 CVE-2026-45709

mediumGitHub GitHub 2026-W21

Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

2026-05-19 CVE-2026-45712

mediumGitHub GitHub 2026-W21

Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

2026-05-19 CVE-2026-45711

mediumGitHub GitHub 2026-W21

Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

2026-05-19 CVE-2026-45713

highGitHub GitHub 2026-W21

Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

2026-05-19 CVE-2026-46412

criticalGitHub GitHub 2026-W21

Malware in @opensearch-project/opensearch

2026-05-19 GHSA-27F5-XJRR-Q9FF

criticalGitHub GitHub 2026-W21