Source: github

veraPDF has potential XSLT injection vulnerability when using policy files

2026-05-14 CVE-2024-28109

view_component: Preview Route Can Dispatch Inherited Helper Methods

2026-05-14 CVE-2026-44836

view_component: System Test Entry Point Path Check Allows Sibling Directory Escape

2026-05-14 CVE-2026-44837

vm2 Has a Sandbox Breakout Using Async Generator

2026-05-14 CVE-2026-45411

criticalGitHub GitHub 2026-W20

wasmtime has a panic when allocating a table exceeding the size of the host's address space

2026-05-14 CVE-2026-44216

@workos/authkit-session has an Open Redirect via state-derived redirect target

2026-05-13 CVE-2026-42565

Addressable has a Regular Expression Denial of Service in Addressable templates

2026-05-13 CVE-2026-35611

Angular Expressions - Remote Code Execution using filters

2026-05-13 CVE-2026-44643

criticalGitHub GitHub 2026-W20

Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions

2026-05-13 CVE-2026-27446

criticalGitHub GitHub 2026-W20

Apache Tomcat Improper Resource Shutdown or Release vulnerability

2026-05-13 CVE-2025-48989

Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

2026-05-13 CVE-2025-55754

Apache Tomcat Vulnerable to Improper Resource Shutdown or Release

2026-05-13 CVE-2025-61795

Apache Tomcat Vulnerable to Relative Path Traversal

2026-05-13 CVE-2025-55752

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

2026-05-13 CVE-2026-42576

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

2026-05-13 CVE-2026-42574

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

2026-05-13 CVE-2026-42575

ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases

2026-05-13 CVE-2026-44221

criticalGitHub GitHub 2026-W20

Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

2026-05-13 CVE-2026-42461

Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

2026-05-13 CVE-2026-42183

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

2026-05-13 CVE-2026-42296

Argo has Missing Authorization in its Sync ConfigMap Provider

2026-05-13 CVE-2026-42297

Argo vulnerable to exposure of artifact repository credentials

2026-05-13 CVE-2026-42295

Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

2026-05-13 CVE-2026-42294

Astro: Server island encrypted parameters vulnerable to cross-component replay

2026-05-13 CVE-2026-45028

auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

2026-05-13 CVE-2026-42560

criticalGitHub GitHub 2026-W20

Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect

2026-05-13 CVE-2026-44681

AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass

2026-05-13 CVE-2026-43874

AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass

2026-05-13 CVE-2026-43879

AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()

2026-05-13 CVE-2026-43884

AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

2026-05-13 CVE-2026-43885

AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content

2026-05-13 CVE-2026-43877

AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers

2026-05-13 CVE-2026-43876

AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

2026-05-13 CVE-2026-43883

AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover

2026-05-13 CVE-2026-43875

AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address

2026-05-13 CVE-2026-43880

AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing

2026-05-13 CVE-2026-43882

AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server

2026-05-13 CVE-2026-43873

AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction

2026-05-13 CVE-2026-43881

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

2026-05-13 CVE-2026-42205

AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass

2026-05-13 CVE-2026-42606

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

2026-05-13 CVE-2026-42605

basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering

2026-05-13 CVE-2026-44240

Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

2026-05-13 CVE-2025-8916

bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

2026-05-13 CVE-2026-40070

bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts

2026-05-13 CVE-2026-40069

changedetection.io has an Arbitrary Local File Read via a crafted backup restore

2026-05-13 CVE-2026-43891

ciguard: Container image runs as root (no USER directive)

2026-05-13 CVE-2026-44218

ciguard: discover_pipeline_files follows symlinks out of scan root

2026-05-13 CVE-2026-44220

ciguard: SCA HTTP client reads response body without size cap

2026-05-13 CVE-2026-44219

Cillium exposes sensitive information included in the cilium-bugtool debug archive

2026-05-13 CVE-2026-41520

claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh

2026-05-13 CVE-2026-45136

Clerk has an authorization bypass when combining organization, billing, or reverification checks

2026-05-13 CVE-2026-42349

Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior

2026-05-13 CVE-2026-44011

Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

2026-05-13 CVE-2026-44010

Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure

2026-05-13 CVE-2026-44012

DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

2026-05-13 CVE-2026-42300

criticalGitHub GitHub 2026-W20

django-s3file is vulnerable to relative path traversal

2026-05-13 CVE-2026-42196

criticalGitHub GitHub 2026-W20

Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

2026-05-13 GHSA-JJ37-3377-M6VV