Security Warnings — Source: github

Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

2026-05-13 CVE-2026-22706

lowGitHub GitHub 2026-W20

Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

2026-05-13 CVE-2026-44724

highGitHub GitHub 2026-W20

TorrentPier Deserialization of Untrusted Data vulnerability

2026-05-13 CVE-2024-40624

criticalGitHub GitHub 2026-W20

TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter

2026-05-13 CVE-2025-64519

highGitHub GitHub 2026-W20

Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

2026-05-13 CVE-2026-44774

mediumGitHub GitHub 2026-W20

UltraJSON has a Memory Leak in ujson.dump() on Write Failure

2026-05-13 CVE-2026-44660

highGitHub GitHub 2026-W20

Unauthorized access to Argo Workflows Template

2026-05-13 CVE-2026-28229

highGitHub GitHub 2026-W20

uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution

2026-05-13 CVE-2026-45152

highGitHub GitHub 2026-W20

Vert.x has a DoS via unbounded server-side SNI SslContext cache growth

2026-05-13 CVE-2026-6860

mediumGitHub GitHub 2026-W20

Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal

2026-05-13 CVE-2026-43878

mediumGitHub GitHub 2026-W20

vLLM Vulnerable to Remote DoS via Special-Token Placeholders

2026-05-13 CVE-2026-44222

mediumGitHub GitHub 2026-W20

vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters

2026-05-13 CVE-2026-44223

mediumGitHub GitHub 2026-W20

Wagtail has improper permission handling when comparing revisions

2026-05-13 CVE-2026-44197

mediumGitHub GitHub 2026-W20

Wagtail has improper permission handling when copying pages

2026-05-13 CVE-2026-44200

mediumGitHub GitHub 2026-W20

Wagtail has improper permission handling when deleting form submissions

2026-05-13 CVE-2026-44199

mediumGitHub GitHub 2026-W20

Wagtail has improper permission handling when viewing page history

2026-05-13 CVE-2026-44198

mediumGitHub GitHub 2026-W20

Wagtail has improper restriction handling on Documents and Images API

2026-05-13 CVE-2026-44201

mediumGitHub GitHub 2026-W20

wger has an Uncontrolled Resource Consumption issue

2026-05-13 GHSA-V25J-WQCW-FVHJ

mediumGitHub GitHub 2026-W20

wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

2026-05-13 CVE-2026-43948

criticalGitHub GitHub 2026-W20

wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured

2026-05-13 CVE-2026-43901

mediumGitHub GitHub 2026-W20

ws affected by a DoS when handling a request with many HTTP headers

2026-05-13 CVE-2024-37890

highGitHub GitHub 2026-W20

YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers

2026-05-13 CVE-2026-43939

highGitHub GitHub 2026-W20

YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

2026-05-13 CVE-2026-43938

highGitHub GitHub 2026-W20

YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`

2026-05-13 CVE-2026-43937

highGitHub GitHub 2026-W20

Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

2026-05-12 CVE-2026-41423

highGitHub GitHub 2026-W20

AstrBot is vulnerable to RCE with hard-coded JWT signing keys

2026-05-12 CVE-2025-55449

criticalGitHub GitHub 2026-W20

Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

2026-05-12 CVE-2026-42264

highGitHub GitHub 2026-W20

Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez

2026-05-12 CVE-2025-68463

mediumGitHub GitHub 2026-W20

Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)

2026-05-12 CVE-2026-45090

highGitHub GitHub 2026-W20

Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option

2026-05-12 CVE-2026-45089

highGitHub GitHub 2026-W20

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`

2026-05-12 CVE-2026-45088

highGitHub GitHub 2026-W20

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

2026-05-12 CVE-2026-45087

criticalGitHub GitHub 2026-W20

Dapr: Service Invocation path traversal ACL bypass

2026-05-12 CVE-2026-41491

highGitHub GitHub 2026-W20

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

2026-05-12 CVE-2026-32686

mediumGitHub GitHub 2026-W20

Duplicate Advisory: LibreNMS affected by an authenticated Cross-site Scripting vulnerability on the showconfig page

2026-05-12 GHSA-RP7W-624X-95QV

mediumGitHub GitHub 2026-W20

Duplicate Advisory: OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay

2026-05-12 GHSA-82RM-QCFX-2V78

mediumGitHub GitHub 2026-W20

electerm has Command Injection via runLinux funtion

2026-05-12 CVE-2026-41501

criticalGitHub GitHub 2026-W20

Ghost has a SQL injection in Content API

2026-05-12 CVE-2026-26980

criticalGitHub GitHub 2026-W20

go-git: Credential leak via cross-host redirect in smart HTTP transport

2026-05-12 CVE-2026-41506

mediumGitHub GitHub 2026-W20

Heimdall has an authorization bypass via path normalization mismatch

2026-05-12 CVE-2026-42274

highGitHub GitHub 2026-W20

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

2026-05-12 CVE-2026-42272

highGitHub GitHub 2026-W20

Heimdall: Case-sensitive host matching may lead to policy bypass

2026-05-12 CVE-2026-42273

highGitHub GitHub 2026-W20

ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

2026-05-12 CVE-2026-40311

mediumGitHub GitHub 2026-W20

Kimai has Missing Object-Level Authorization in the Team API

2026-05-12 CVE-2026-41498

lowGitHub GitHub 2026-W20

Kimai vulnerable to formula Injection via tag names in XLSX export

2026-05-12 CVE-2026-42267

mediumGitHub GitHub 2026-W20

LibreNMS has an Authenticated OS Command Injection

2026-05-12 CVE-2024-51092

criticalGitHub GitHub 2026-W20

LiteLLM has SQL Injection in Proxy API key verification

2026-05-12 CVE-2026-42208

criticalGitHub GitHub 2026-W20

LiteLLM: Authenticated command execution via MCP stdio test endpoints

2026-05-12 CVE-2026-42271

highGitHub GitHub 2026-W20

LiteLLM: Server-Side Template Injection in /prompts/test endpoint

2026-05-12 CVE-2026-42203

highGitHub GitHub 2026-W20

Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

2026-05-12 CVE-2026-41149

mediumGitHub GitHub 2026-W20

Mermaid: Improper sanitization of configuration leads to CSS injection

2026-05-12 CVE-2026-41159

mediumGitHub GitHub 2026-W20

next-npm-version is vulnerable to Command injection

2026-05-12 CVE-2025-63706

criticalGitHub GitHub 2026-W20

Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass

2026-05-12 CVE-2026-41574

criticalGitHub GitHub 2026-W20

node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js

2026-05-12 CVE-2025-63705

highGitHub GitHub 2026-W20

OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS

2026-05-12 CVE-2026-42073

mediumGitHub GitHub 2026-W20

OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input

2026-05-12 CVE-2026-42074

criticalGitHub GitHub 2026-W20

OpenClaw validates Zalo outbound photo URLs through the SSRF guard

2026-05-12 CVE-2026-44116

mediumGitHub GitHub 2026-W20

OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage

2026-05-12 CVE-2026-43580

mediumGitHub GitHub 2026-W20

OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding

2026-05-12 CVE-2026-43582

mediumGitHub GitHub 2026-W20

OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets

2026-05-12 CVE-2026-43576

mediumGitHub GitHub 2026-W20