Vendor: github

Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions

2026-05-20 GHSA-5WXR-W449-57CM

Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

2026-05-20 CVE-2026-46421

criticalGitHub GitHub 2026-W21

TeleJSON: DOM XSS via unsanitised constructor name in `new Function()`

2026-05-20 CVE-2026-47099

wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None

2026-05-20 GHSA-MW8F-W6P8-XRF4

@angular/platform-server: SSRF via Hostname Hijacking

2026-05-19 CVE-2026-46417

@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files

2026-05-19 CVE-2026-22810

@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

2026-05-19 CVE-2026-45783

9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

2026-05-19 CVE-2026-46339

criticalGitHub GitHub 2026-W21

Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication

2026-05-19 GHSA-9V4J-7G44-QCQW

Algernon: handler.lua discovery walks parent directories above the server root

2026-05-19 CVE-2026-45721

criticalGitHub GitHub 2026-W21

Algernon: Single-file mode unconditionally enables debug mode

2026-05-19 CVE-2026-45728

Anchor: `InterfaceAccount` allows account substitution between unexpected types

2026-05-19 GHSA-429Q-FHH4-R6HJ

Anchor: Program<'info, System> is not properly validated

2026-05-19 CVE-2026-45137

Apache Avro Rust SDK's Reader could consume memory beyond allowed constraints

2026-05-19 CVE-2022-36124

Apache Tomcat - AJP secret compared in non-constant time

2026-05-19 CVE-2026-43514

Apache Tomcat - Security constraints not correctly applied

2026-05-19 CVE-2026-43515

criticalGitHub GitHub 2026-W21

Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

2026-05-19 CVE-2026-46341

Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation

2026-05-19 CVE-2026-45013

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

2026-05-19 CVE-2026-45737

Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

2026-05-19 CVE-2026-45738

auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs

2026-05-19 GHSA-HV85-774V-26FG

AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`

2026-05-19 CVE-2026-46337

Bandit: Unauthenticated DoS via chunked request trailers in Bandit HTTP/1 decoder

2026-05-19 CVE-2026-39806

Bandit: Unauthenticated one-shot DoS via `Transfer-Encoding: chunked`

2026-05-19 CVE-2026-39803

Bouncy Castle has a vulnerability in program files gcm128w, gcm512w

2026-05-19 CVE-2026-8149

Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour

2026-05-19 CVE-2026-46424

Budibase: Unrestricted Upload of File with Dangerous Type

2026-05-19 CVE-2026-46426

Caddy CVE-2026-30852 Fix Bypass

2026-05-19 GHSA-WWHQ-W58M-W29C

Caddy Defender trusted proxy client IP bypass

2026-05-19 CVE-2026-46415

Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

2026-05-19 CVE-2026-45692

Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching

2026-05-19 GHSA-GX7W-56W6-G48X

CamoFox MCP: Unauthenticated HTTP MCP browser-control surface

2026-05-19 GHSA-7HGR-7H44-33W2

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

2026-05-19 CVE-2026-46354

criticalGitHub GitHub 2026-W21

Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint

2026-05-19 CVE-2026-45796

Cowboy: Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy

2026-05-19 CVE-2026-8466

cowlib: Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

2026-05-19 CVE-2026-43970

Cross-site request forgery in Django

2026-05-19 CVE-2011-0696

Cross-site scripting in django

2026-05-19 CVE-2011-0697

Cross-site Scripting in Ericsson CodeChecker

2026-05-19 CVE-2021-44217

Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal

2026-05-19 CVE-2026-46378

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

2026-05-19 CVE-2026-46377

Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`

2026-05-19 GHSA-M9P2-FXP5-V3FP

Diesel: Possible unaligned data access for implementations of `SqliteAggregate`

2026-05-19 GHSA-Q8X8-JRHJ-FH9P

Envoy AI Proxy - MCP Message Smuggling Vulnerability

2026-05-19 GHSA-4GPH-2HHR-5MWG

fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

2026-05-19 CVE-2026-45581

FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation

2026-05-19 CVE-2026-27964

FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

2026-05-19 CVE-2026-27892

Fava time and filter parameters vulnerable to reflected Cross-site Scripting

2026-05-19 CVE-2022-2514

FileBrowser Quantum: unauthenticated user share share info

2026-05-19 CVE-2026-46410

Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default

2026-05-19 CVE-2024-6221

FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

2026-05-19 CVE-2026-45802

Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

2026-05-19 CVE-2026-45793

GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

2026-05-19 CVE-2026-45803

Gradio Path Traversal vulnerability

2026-05-19 CVE-2024-0964

HashiCorp Nomad vulnerable to a path traversal

2026-05-19 CVE-2026-7474

HashiCorp Nomad vulnerable to symlink attack

2026-05-19 CVE-2026-6959

HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack

2026-05-19 CVE-2026-8052

HAX CMS: Denial of Service using Malicious Import Request

2026-05-19 CVE-2026-46357

HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

2026-05-19 CVE-2026-46496