Cross-site Scripting (XSS)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the CraftSupportWidget.js process. An attacker can execute arbitrary JavaScript code in the admin's control panel session by crafting a malicious GitHub issue tit...

GHSA-24X4-J6X9-RFW5 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Summary An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session...

EUVD-2026-41209

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget...

CVE-2026-59710

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...

CVE-2026-55786

creationtimestamp| type| source ---|---|--- 2026-07-06 18:35:06+00:00| published-proof-of-concept| https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85...

GHSA-7JVP-HJ45-2F2M

creationtimestamp| type| source ---|---|--- 2026-07-06 17:41:59+00:00| seen| https://gist.github.com/alon710/3392c028816ef9767631ce548afd9d91...

CVE-2026-48995

A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to serve malicious software packages if the codeload.github.com server is compromised or a user's machine configuration is tampered with. The issue arises because pnpm does not verify the integrity of...

PYSEC-2026-952 Incomplete validation in signal ops leads to crashes in TensorFlow

Impact The tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes due to CHECK-failures. Patches We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 merging GitHub PR 55274. The fix will be...

GHSA-J687-52P2-XCFF

creationtimestamp| type| source ---|---|--- 2026-07-05 13:35:36+00:00| seen| https://gist.github.com/konard/88609dd395d6031e4d410d3826dc1450...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the LFS object reuse process. An attacker can gain unauthorized access to private source objects by leveraging repository access without having the required Code-unit permissions...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the CODEOWNERS pattern matching process. An attacker can cause excessive resource consumption by submitting specially crafted patterns, potentially leading to service unavailability. Remediation Upgrade...

CVE-2026-57168

creationtimestamp| type| source ---|---|--- 2026-07-02 22:35:13+00:00| published-proof-of-concept| https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf...

CVE-2026-52817

creationtimestamp| type| source ---|---|--- 2026-07-02 22:35:11+00:00| published-proof-of-concept| https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-8w6w-23mq-h8rg...

CVE-2026-52834

creationtimestamp| type| source ---|---|--- 2026-07-02 22:35:09+00:00| published-proof-of-concept| https://github.com/tirr-c/jxl-oxide/security/advisories/GHSA-5pmv-rx8r-wmv5...

CVE-2026-49852

creationtimestamp| type| source ---|---|--- 2026-07-02 20:35:04+00:00| published-proof-of-concept| https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh 2026-07-17 22:08:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqur7v4av42e...

GHSA-9H3P-52VH-959W vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

CVE-2026-58578

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...

CVE-2026-58578 LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...

CVE-2026-58578

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...

CVE-2026-50181

creationtimestamp| type| source ---|---|--- 2026-07-02 18:35:09+00:00| published-proof-of-concept| https://github.com/langroid/langroid/security/advisories/GHSA-fg23-3346-88f5 2026-07-13 22:00:06+00:00| seen| https://t.me/GithubRedTeam/92599 2026-07-14 00:00:10+00:00| seen|...