Froxlor < 0.10.38.2. - HTML Injection

HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. id: CVE-2022-3869 info: name: Froxlor TEST" matchers-condition: and matchers: - type: word part: body words: - 'The message to ""TEST" failed' - type: word part: header words: - "text/html" - type: status status: - 200 d...

Mosparo < 1.0.2 - Open Redirect

Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. id: CVE-2023-5375 info: name: Mosparo 1.0.2 - Open Redirect author: shankaracharya severity: medium description: | Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. impact: | Unauthenticated attackers can exploit...

Imgproxy < 3.14.0 - Cross-site Scripting (XSS)

Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0. id: CVE-2023-1496 info: name: Imgproxy 3.14.0 - Cross-site Scripting XSS author: pdteam severity: medium description: Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to...

GO-2026-5980 yutu: Arbitrary File Write via MCP `caption-download` Tool in github.com/eat-pray-ai/yutu

yutu: Arbitrary File Write via MCP caption-download Tool in github.com/eat-pray-ai/yutu...

Malicious code in @luminarycloudinternal/frodo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58ed68e675b2b6cde30e6b7c8e34077eda805a4bde64ca7cd2c68c6f4370ee5f Package published under a scope shadowing internal Luminary Cloud packages @luminarycloudinternal at version 9999.0.1 — the canonical...

github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability

A flaw was found in github.com/jackc/pgx. This memory-safety vulnerability could potentially lead to unexpected behavior or system instability...

GO-2026-5867 picoclaw is vulnerable to OS command injection via the ExecTool component in github.com/sipeed/picoclaw

picoclaw is vulnerable to OS command injection via the ExecTool component in github.com/sipeed/picoclaw...

GO-2026-5847 Kahi has privilege-drop and socket/log permission issues in github.com/kahiteam/kahi

Kahi has privilege-drop and socket/log permission issues in github.com/kahiteam/kahi...

PYSEC-2026-907 Cross-site Scripting in pyload-ng

Cross-site Scripting XSS - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42...

PYSEC-2026-541 Tooxie Shiva 0.10.0 allows absolute path traversal because Flask send_file function used unsafely

The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

GO-2026-5756 AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle in github.com/AdguardTeam/AdGuardHome

AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle in github.com/AdguardTeam/AdGuardHome...

GO-2026-5755 Canonical MicroCeph: path traversal issue in the remote-import AP in github.com/canonical/microceph/microceph

Canonical MicroCeph: path traversal issue in the remote-import AP in github.com/canonical/microceph/microceph...

GO-2026-5674 OpenBao's Namespace Deletion May Not Delete Data Properly in github.com/openbao/openbao

OpenBao's Namespace Deletion May Not Delete Data Properly in github.com/openbao/openbao...

GO-2026-5517 OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao

OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao...

GO-2026-5557 Note Mark: OIDC-registered users authenticated by submitting password "null" in github.com/enchant97/note-mark/backend

Note Mark: OIDC-registered users authenticated by submitting password "null" in github.com/enchant97/note-mark/backend...

GO-2026-5626 Ech0 comment model's Email field returned on public /api/comments endpoints in github.com/lin-snow/ech0

Ech0 comment model's Email field returned on public /api/comments endpoints in github.com/lin-snow/ech0...

GO-2026-5623 Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation in github.com/lin-snow/ech0

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation in github.com/lin-snow/ech0...

GO-2026-5588 Netmaker does not verify JWT signatures for host tokens in github.com/gravitl/netmaker

Netmaker does not verify JWT signatures for host tokens in github.com/gravitl/netmaker...

GO-2026-5464 androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers) in github.com/mvt-project/androidqf

androidqf: Zip entry Name Injection in APK bundle Zip Slip for zip consumers in github.com/mvt-project/androidqf...

GO-2026-5375 ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0...