Security Warnings — Vendor: github

requests-hardened is Vulnerable to Server-Side Request Forgery

2026-05-13 CVE-2026-42175

mediumGitHub GitHub 2026-W20

RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency

2026-05-13 CVE-2025-22871

criticalGitHub GitHub 2026-W20

russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler

2026-05-13 CVE-2026-42189

highGitHub GitHub 2026-W20

S3-Proxy has Security Issues in its Resource Path Matching Implementation

2026-05-13 CVE-2026-42882

criticalGitHub GitHub 2026-W20

Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

2026-05-13 CVE-2026-41901

criticalGitHub GitHub 2026-W20

SandboxJS has a sandbox escape via Function.caller leakage of internal call op

2026-05-13 CVE-2026-43898

criticalGitHub GitHub 2026-W20

Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules

2026-05-13 CVE-2026-44262

criticalGitHub GitHub 2026-W20

sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

2026-05-13 CVE-2026-45091

criticalGitHub GitHub 2026-W20

Sentry's improper authentication on SAML SSO process allows user identity linking

2026-05-13 CVE-2026-42354

criticalGitHub GitHub 2026-W20

short-video-maker has a path traversal vulnerability

2026-05-13 CVE-2026-8115

mediumGitHub GitHub 2026-W20

Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

2026-05-13 CVE-2026-41893

highGitHub GitHub 2026-W20

SillyTavern has a Path Traversal issue

2026-05-13 CVE-2026-44650

criticalGitHub GitHub 2026-W20

SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware

2026-05-13 CVE-2026-44651

mediumGitHub GitHub 2026-W20

SillyTavern has a SSRF vulnerability in the CORS proxy middleware

2026-05-13 CVE-2026-44652

mediumGitHub GitHub 2026-W20

SillyTavern has Authentication Bypass via SSO Header Injection

2026-05-13 CVE-2026-44649

criticalGitHub GitHub 2026-W20

SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE

2026-05-13 CVE-2026-44670

criticalGitHub GitHub 2026-W20

SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

2026-05-13 CVE-2026-45375

criticalGitHub GitHub 2026-W20

SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode

2026-05-13 CVE-2026-45148

mediumGitHub GitHub 2026-W20

SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs

2026-05-13 CVE-2026-45371

highGitHub GitHub 2026-W20

SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

2026-05-13 CVE-2026-45147

mediumGitHub GitHub 2026-W20

Snappier has an infinite loop during SnappyStream decompression with malformed framed input

2026-05-13 CVE-2026-44302

highGitHub GitHub 2026-W20

Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key

2026-05-13 CVE-2026-22738

criticalGitHub GitHub 2026-W20

sse-channel: SSE Injection via unsanitized event fields

2026-05-13 CVE-2026-44217

mediumGitHub GitHub 2026-W20

ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs

2026-05-13 CVE-2026-43929

highGitHub GitHub 2026-W20

Statamic CMS vulnerable to email enumeration via forgot password endpoint

2026-05-13 CVE-2026-44306

mediumGitHub GitHub 2026-W20

Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying

2026-05-13 CVE-2025-64526

mediumGitHub GitHub 2026-W20

Strapi Vulnerable to SQL Injection in Content Type Builder

2026-05-13 CVE-2026-22599

criticalGitHub GitHub 2026-W20

Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

2026-05-13 CVE-2026-22706

lowGitHub GitHub 2026-W20

Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

2026-05-13 CVE-2026-44724

highGitHub GitHub 2026-W20

TorrentPier Deserialization of Untrusted Data vulnerability

2026-05-13 CVE-2024-40624

criticalGitHub GitHub 2026-W20

TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter

2026-05-13 CVE-2025-64519

highGitHub GitHub 2026-W20

Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

2026-05-13 CVE-2026-44774

mediumGitHub GitHub 2026-W20

UltraJSON has a Memory Leak in ujson.dump() on Write Failure

2026-05-13 CVE-2026-44660

highGitHub GitHub 2026-W20

Unauthorized access to Argo Workflows Template

2026-05-13 CVE-2026-28229

highGitHub GitHub 2026-W20

uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution

2026-05-13 CVE-2026-45152

highGitHub GitHub 2026-W20

Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal

2026-05-13 CVE-2026-43878

mediumGitHub GitHub 2026-W20

vLLM Vulnerable to Remote DoS via Special-Token Placeholders

2026-05-13 CVE-2026-44222

mediumGitHub GitHub 2026-W20

vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters

2026-05-13 CVE-2026-44223

mediumGitHub GitHub 2026-W20

Wagtail has improper permission handling when comparing revisions

2026-05-13 CVE-2026-44197

mediumGitHub GitHub 2026-W20

Wagtail has improper permission handling when copying pages

2026-05-13 CVE-2026-44200

mediumGitHub GitHub 2026-W20

Wagtail has improper permission handling when deleting form submissions

2026-05-13 CVE-2026-44199

mediumGitHub GitHub 2026-W20

Wagtail has improper permission handling when viewing page history

2026-05-13 CVE-2026-44198

mediumGitHub GitHub 2026-W20

Wagtail has improper restriction handling on Documents and Images API

2026-05-13 CVE-2026-44201

mediumGitHub GitHub 2026-W20

wger has an Uncontrolled Resource Consumption issue

2026-05-13 GHSA-V25J-WQCW-FVHJ

mediumGitHub GitHub 2026-W20

wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

2026-05-13 CVE-2026-43948

criticalGitHub GitHub 2026-W20

wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured

2026-05-13 CVE-2026-43901

mediumGitHub GitHub 2026-W20

ws affected by a DoS when handling a request with many HTTP headers

2026-05-13 CVE-2024-37890

highGitHub GitHub 2026-W20

YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers

2026-05-13 CVE-2026-43939

highGitHub GitHub 2026-W20

YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

2026-05-13 CVE-2026-43938

highGitHub GitHub 2026-W20

YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`

2026-05-13 CVE-2026-43937

highGitHub GitHub 2026-W20

Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

2026-05-12 CVE-2026-41423

highGitHub GitHub 2026-W20

AstrBot is vulnerable to RCE with hard-coded JWT signing keys

2026-05-12 CVE-2025-55449

criticalGitHub GitHub 2026-W20

Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

2026-05-12 CVE-2026-42264

highGitHub GitHub 2026-W20

Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez

2026-05-12 CVE-2025-68463

mediumGitHub GitHub 2026-W20

Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)

2026-05-12 CVE-2026-45090

highGitHub GitHub 2026-W20

Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option

2026-05-12 CVE-2026-45089

highGitHub GitHub 2026-W20

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`

2026-05-12 CVE-2026-45088

highGitHub GitHub 2026-W20

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

2026-05-12 CVE-2026-45087

criticalGitHub GitHub 2026-W20

Dapr: Service Invocation path traversal ACL bypass

2026-05-12 CVE-2026-41491

highGitHub GitHub 2026-W20

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

2026-05-12 CVE-2026-32686

mediumGitHub GitHub 2026-W20