Vendor: github

Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability

2026-05-18 CVE-2026-35433

Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability

2026-05-18 CVE-2026-42899

multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing

2026-05-18 CVE-2026-8162

multiparty vulnerable to ReDoS via filename parsing

2026-05-18 CVE-2026-8159

multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception

2026-05-18 CVE-2026-8161

n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete

2026-05-18 CVE-2026-45707

NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

2026-05-18 CVE-2026-45553

NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

2026-05-18 CVE-2026-45554

omec-project amf crashes when processing malformed LocationReports

2026-05-18 CVE-2026-8349

lowGitHub GitHub 2026-W21

OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

2026-05-18 CVE-2026-45682

OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size

2026-05-18 CVE-2026-45681

OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure

2026-05-18 CVE-2026-45683

lowGitHub GitHub 2026-W21

OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers

2026-05-18 CVE-2026-45684

OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

2026-05-18 CVE-2026-45686

OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

2026-05-18 CVE-2026-45685

OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

2026-05-18 CVE-2026-45678

OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

2026-05-18 CVE-2026-45679

OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU

2026-05-18 CVE-2026-45680

OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

2026-05-18 CVE-2026-45676

Postgrex: Channel-name SQL injection in `Postgrex.Notifications.listen/3`

2026-05-18 CVE-2026-32687

PySyft server-side arbitrary Python execution after code approval

2026-05-18 CVE-2026-31220

criticalGitHub GitHub 2026-W21

PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

2026-05-18 CVE-2026-31221

Snorkel BaseLabeler.load uses an unsafe pickle.load

2026-05-18 CVE-2026-31223

Snorkel MultitaskClassifier.load uses an unsafe torch.load

2026-05-18 CVE-2026-31224

Snorkel Trainer.load uses an unsafe torch.load

2026-05-18 CVE-2026-31222

Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

2026-05-18 CVE-2026-41712

Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor

2026-05-18 CVE-2026-41713

Sulu: Used API Keys may be available via Admin API

2026-05-18 GHSA-9M6V-8FXC-4R44

lowGitHub GitHub 2026-W21

Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

2026-05-18 CVE-2026-45701

Superduper: Remote code execution via unsafe eval in superduper query parsing

2026-05-18 CVE-2026-31225

TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

2026-05-18 CVE-2026-45327

ws: Uninitialized memory disclosure

2026-05-18 CVE-2026-45736

Dulwich Arbitrary code execution via commit with directory path starting with .git

2026-05-15 CVE-2014-9706

criticalGitHub GitHub 2026-W20

Gogs Directory Traversal

2026-05-15 CVE-2018-20303

Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation

2026-05-15 CVE-2026-45396

Svelte devalue: DoS via sparse array deserialization

2026-05-15 CVE-2026-42570

@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation

2026-05-14 GHSA-WF8Q-WVV8-P8JF

criticalGitHub GitHub 2026-W20

@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

2026-05-14 CVE-2026-45366

Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)

2026-05-14 CVE-2026-44504

Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

2026-05-14 CVE-2026-44437

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

2026-05-14 CVE-2026-42601

criticalGitHub GitHub 2026-W20

Authlib: Cross-site request forging when using cache

2026-05-14 CVE-2026-41425

AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion

2026-05-14 CVE-2026-32933

Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

2026-05-14 CVE-2026-44374

bettercap Has an Integer Coercion Error in modules/mysql_server/mysql_server.go

2026-05-14 CVE-2026-8276

lowGitHub GitHub 2026-W20

bettercap Has an Integer Coercion Error in the ippReadChunkedBody Function

2026-05-14 CVE-2026-8275

lowGitHub GitHub 2026-W20

changedetection.io project has an XXE vulnerability

2026-05-14 CVE-2026-41895

Compromise of PyTorch Lightning PyPi Package Versions

2026-05-14 CVE-2026-44484

criticalGitHub GitHub 2026-W20

CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content

2026-05-14 CVE-2026-44312

DevSpace UI Server WebSocket CheckOrigin does not validate source

2026-05-14 CVE-2026-42283

Distribution's tag deletion bypasses `storage.delete.enabled` configuration

2026-05-14 CVE-2026-41888

docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler

2026-05-14 CVE-2026-44520

etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests

2026-05-14 CVE-2026-44283

lowGitHub GitHub 2026-W20

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

2026-05-14 CVE-2026-44542

criticalGitHub GitHub 2026-W20

FlowiseAI Exposes Basic Auth Credentials via API

2026-05-14 CVE-2026-46440

FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment

2026-05-14 CVE-2026-46441

FlowiseAI Vulnerable to Credential Data Leak

2026-05-14 CVE-2026-46443

FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover

2026-05-14 CVE-2026-46475