Security Warnings — Vendor: github

AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()

2026-05-13 CVE-2026-43884

highGitHub GitHub 2026-W20

AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

2026-05-13 CVE-2026-43885

highGitHub GitHub 2026-W20

AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content

2026-05-13 CVE-2026-43877

mediumGitHub GitHub 2026-W20

AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers

2026-05-13 CVE-2026-43876

mediumGitHub GitHub 2026-W20

AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

2026-05-13 CVE-2026-43883

mediumGitHub GitHub 2026-W20

AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover

2026-05-13 CVE-2026-43875

mediumGitHub GitHub 2026-W20

AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address

2026-05-13 CVE-2026-43880

mediumGitHub GitHub 2026-W20

AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing

2026-05-13 CVE-2026-43882

mediumGitHub GitHub 2026-W20

AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server

2026-05-13 CVE-2026-43873

highGitHub GitHub 2026-W20

AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction

2026-05-13 CVE-2026-43881

mediumGitHub GitHub 2026-W20

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

2026-05-13 CVE-2026-42205

highGitHub GitHub 2026-W20

AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass

2026-05-13 CVE-2026-42606

highGitHub GitHub 2026-W20

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

2026-05-13 CVE-2026-42605

highGitHub GitHub 2026-W20

basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering

2026-05-13 CVE-2026-44240

highGitHub GitHub 2026-W20

Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

2026-05-13 CVE-2025-8916

mediumGitHub GitHub 2026-W20

bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

2026-05-13 CVE-2026-40070

highGitHub GitHub 2026-W20

bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts

2026-05-13 CVE-2026-40069

highGitHub GitHub 2026-W20

changedetection.io has an Arbitrary Local File Read via a crafted backup restore

2026-05-13 CVE-2026-43891

highGitHub GitHub 2026-W20

ciguard: Container image runs as root (no USER directive)

2026-05-13 CVE-2026-44218

lowGitHub GitHub 2026-W20

ciguard: discover_pipeline_files follows symlinks out of scan root

2026-05-13 CVE-2026-44220

lowGitHub GitHub 2026-W20

ciguard: SCA HTTP client reads response body without size cap

2026-05-13 CVE-2026-44219

mediumGitHub GitHub 2026-W20

Cillium exposes sensitive information included in the cilium-bugtool debug archive

2026-05-13 CVE-2026-41520

highGitHub GitHub 2026-W20

claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh

2026-05-13 CVE-2026-45136

highGitHub GitHub 2026-W20

Clerk has an authorization bypass when combining organization, billing, or reverification checks

2026-05-13 CVE-2026-42349

highGitHub GitHub 2026-W20

Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior

2026-05-13 CVE-2026-44011

highGitHub GitHub 2026-W20

Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

2026-05-13 CVE-2026-44010

highGitHub GitHub 2026-W20

Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure

2026-05-13 CVE-2026-44012

highGitHub GitHub 2026-W20

DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

2026-05-13 CVE-2026-42300

criticalGitHub GitHub 2026-W20

django-s3file is vulnerable to relative path traversal

2026-05-13 CVE-2026-42196

criticalGitHub GitHub 2026-W20

Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

2026-05-13 GHSA-JJ37-3377-M6VV

highGitHub GitHub 2026-W20

Electerm users can run dangrous code through link or command line

2026-05-13 CVE-2026-43944

criticalGitHub GitHub 2026-W20

esm.sh: Legacy Route Path Traversal Can Lead to RCE

2026-05-13 CVE-2026-44593

criticalGitHub GitHub 2026-W20

esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files

2026-05-13 CVE-2026-44594

highGitHub GitHub 2026-W20

Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection

2026-05-13 CVE-2026-42303

mediumGitHub GitHub 2026-W20

exiftool-vendored vulnerable to argument injection via newline characters in tag names

2026-05-13 CVE-2026-43893

highGitHub GitHub 2026-W20

External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

2026-05-13 CVE-2026-42875

mediumGitHub GitHub 2026-W20

ExternalSecrets vulnerable to privilege escalation with secret overwriting

2026-05-13 CVE-2026-42876

mediumGitHub GitHub 2026-W20

Fiber vulnerable to XSS in AutoFormat Content Negotiation

2026-05-13 CVE-2026-42554

mediumGitHub GitHub 2026-W20

FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

2026-05-13 CVE-2026-42864

criticalGitHub GitHub 2026-W20

Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)

2026-05-13 CVE-2026-41887

mediumGitHub GitHub 2026-W20

Flowise: Bcrypt Password Hash Exposure

2026-05-13 CVE-2026-8026

mediumGitHub GitHub 2026-W20

Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

2026-05-13 CVE-2026-43995

mediumGitHub GitHub 2026-W20

Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser

2026-05-13 CVE-2026-42188

lowGitHub GitHub 2026-W20

GitPython: Unsafe option check validates multi_options before shlex.split transformation

2026-05-13 CVE-2026-42284

highGitHub GitHub 2026-W20

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

2026-05-13 CVE-2026-44740

mediumGitHub GitHub 2026-W20

Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy

2026-05-13 CVE-2026-45083

criticalGitHub GitHub 2026-W20

Grafana public dashboards disclose all direct mode datasources

2026-05-13 CVE-2026-27877

mediumGitHub GitHub 2026-W20

Granian vulnerable to DoS via WSGI response header panic

2026-05-13 CVE-2026-42545

mediumGitHub GitHub 2026-W20

Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic

2026-05-13 CVE-2026-42544

highGitHub GitHub 2026-W20

Grav API Privilege Escalation to Super Admin

2026-05-13 CVE-2026-42843

highGitHub GitHub 2026-W20

Grav CMS vulnerable to stored XSS via Markdown media attribute() action

2026-05-13 CVE-2026-42841

mediumGitHub GitHub 2026-W20

Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override

2026-05-13 CVE-2026-42845

highGitHub GitHub 2026-W20

Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component

2026-05-13 CVE-2026-42608

highGitHub GitHub 2026-W20

Grav is Vulnerable to Stored XSS via Tag Injection

2026-05-13 CVE-2026-42611

highGitHub GitHub 2026-W20

Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

2026-05-13 CVE-2026-42609

highGitHub GitHub 2026-W20

Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access

2026-05-13 CVE-2026-42613

criticalGitHub GitHub 2026-W20

Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes

2026-05-13 CVE-2026-42612

highGitHub GitHub 2026-W20

Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

2026-05-13 CVE-2026-42607

criticalGitHub GitHub 2026-W20

Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass

2026-05-13 CVE-2026-42610

mediumGitHub GitHub 2026-W20

Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel

2026-05-13 CVE-2026-42842

mediumGitHub GitHub 2026-W20