Vendor: github

net-imap vulnerable to command Injection via unvalidated Symbol inputs

2026-05-14 CVE-2026-42258

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

2026-05-14 CVE-2026-42256

net-imap vulnerable to STARTTLS stripping via invalid response timing

2026-05-14 CVE-2026-42246

Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`

2026-05-14 CVE-2026-44373

Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

2026-05-14 CVE-2026-44372

OpenBao's Namespace Deletion May Not Delete Data Properly

2026-05-14 CVE-2026-42186

Playwright Capture permits access to local files and internal network resources during page capture

2026-05-14 CVE-2026-44439

python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

2026-05-14 CVE-2026-45370

ShellHub has crash-DoS via field injection in filter and sort-by parameters

2026-05-14 CVE-2026-44425

ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace

2026-05-14 CVE-2026-44424

ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check

2026-05-14 CVE-2026-44426

ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data

2026-05-14 CVE-2026-44423

SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

2026-05-14 CVE-2026-44648

slack-go `SecretsVerifier` accepts empty signing secret without precondition

2026-05-14 GHSA-GXHX-2686-5H9G

SpiceDB WriteRelationships fails silently if payload is too big

2026-05-14 CVE-2025-64529

SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results

2026-05-14 CVE-2025-65111

Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications

2026-05-14 CVE-2026-44308

Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `proto` own properties

2026-05-14 GHSA-MWV9-GP5H-FRR4

utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

2026-05-14 CVE-2026-45369

criticalGitHub GitHub 2026-W20

Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer

2026-05-14 CVE-2026-44516

Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users

2026-05-14 CVE-2026-42555

criticalGitHub GitHub 2026-W20

veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability

2026-05-14 CVE-2024-52800

veraPDF has potential XSLT injection vulnerability when using policy files

2026-05-14 CVE-2024-28109

view_component: Preview Route Can Dispatch Inherited Helper Methods

2026-05-14 CVE-2026-44836

view_component: System Test Entry Point Path Check Allows Sibling Directory Escape

2026-05-14 CVE-2026-44837

vm2 Has a Sandbox Breakout Using Async Generator

2026-05-14 CVE-2026-45411

criticalGitHub GitHub 2026-W20

wasmtime has a panic when allocating a table exceeding the size of the host's address space

2026-05-14 CVE-2026-44216

@workos/authkit-session has an Open Redirect via state-derived redirect target

2026-05-13 CVE-2026-42565

Addressable has a Regular Expression Denial of Service in Addressable templates

2026-05-13 CVE-2026-35611

Angular Expressions - Remote Code Execution using filters

2026-05-13 CVE-2026-44643

criticalGitHub GitHub 2026-W20

Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions

2026-05-13 CVE-2026-27446

criticalGitHub GitHub 2026-W20

Apache Tomcat Improper Resource Shutdown or Release vulnerability

2026-05-13 CVE-2025-48989

Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

2026-05-13 CVE-2025-55754

Apache Tomcat Vulnerable to Improper Resource Shutdown or Release

2026-05-13 CVE-2025-61795

Apache Tomcat Vulnerable to Relative Path Traversal

2026-05-13 CVE-2025-55752

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

2026-05-13 CVE-2026-42576

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

2026-05-13 CVE-2026-42574

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

2026-05-13 CVE-2026-42575

ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases

2026-05-13 CVE-2026-44221

criticalGitHub GitHub 2026-W20

Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

2026-05-13 CVE-2026-42461

Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

2026-05-13 CVE-2026-42183

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

2026-05-13 CVE-2026-42296

Argo has Missing Authorization in its Sync ConfigMap Provider

2026-05-13 CVE-2026-42297

Argo vulnerable to exposure of artifact repository credentials

2026-05-13 CVE-2026-42295

Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

2026-05-13 CVE-2026-42294

Astro: Server island encrypted parameters vulnerable to cross-component replay

2026-05-13 CVE-2026-45028

auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

2026-05-13 CVE-2026-42560

criticalGitHub GitHub 2026-W20

Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect

2026-05-13 CVE-2026-44681

AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass

2026-05-13 CVE-2026-43874

AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass

2026-05-13 CVE-2026-43879

AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()

2026-05-13 CVE-2026-43884

AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

2026-05-13 CVE-2026-43885

AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content

2026-05-13 CVE-2026-43877

AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers

2026-05-13 CVE-2026-43876

AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

2026-05-13 CVE-2026-43883

AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover

2026-05-13 CVE-2026-43875

AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address

2026-05-13 CVE-2026-43880

AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing

2026-05-13 CVE-2026-43882

AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server

2026-05-13 CVE-2026-43873