📡 NVD-Latest · 2026-05-05 CVE-2026-34408 (CVSS 9.1) - An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4. CVE-2026-34408 CVE-2026-34408 CVSS:9.1 An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.

📡 GitHub-Advisory · 2026-05-06 CVE-2026-44456 - Hono: bodyLimit() can be bypassed for chunked / unknown-length requests CVE-2026-44456 GHSA-9vqf-7f2p-gf9v MEDIUM npm/hono CVE: CVE-2026-44456 Summary bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. Details For

📡 GitHub-Advisory · 2026-05-06 CVE-2026-44455 - hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection CVE-2026-44455 GHSA-69xw-7hcm-h432 MEDIUM npm/hono CVE: CVE-2026-44455 Summary Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input

📡 GitHub-Advisory · 2026-05-06 GHSA-qxrw-f6fh-34r7 - Lemmy resend-verification endpoint exposes registered email addresses to unauthe GHSA-qxrw-f6fh-34r7 MEDIUM rust/lemmy_api CVE: Summary The unauthenticated resend-verification endpoint returns different responses for registered and unregistered email addresses. A malicious third party can submit candidate addresses to /api/v4/account/auth/resend_verification_email and

📡 GitHub-Advisory · 2026-05-06 CVE-2026-44439 - Playwright Capture permits access to local files and internal network resources CVE-2026-44439 GHSA-687h-xw6f-q2qw MEDIUM pip/PlaywrightCapture CVE: CVE-2026-44439 Playwright Capture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to

📡 GitHub-Advisory · 2026-05-06 CVE-2026-44437 - Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefi CVE-2026-44437 GHSA-69xr-m8h6-h664 MEDIUM npm/@angular/ssr CVE: CVE-2026-44437 Description A vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly account for URL-encoded characters, specifically dots (%2e%

📡 GitHub-Advisory · 2026-05-06 GHSA-qcxq-75wr-5cm8 - ldap3_proto has LDAP Filter stack exhaustion GHSA-qcxq-75wr-5cm8 HIGH rust/ldap3_proto CVE: Impact LDAP queries are not validated for depth, which can cause the parser (both PEG and ASN) to exhaust the stack. This *may* cause a denial of service in applications that process queries.

📡 GitHub-Advisory · 2026-05-06 GHSA-84jc-3hj2-hwc7 - kanidmd_lib: Image upload validators run before authorization; PNG validator pan GHSA-84jc-3hj2-hwc7 MEDIUM rust/kanidmd_lib CVE: Summary The POST /v1/domain/_image and POST /v1/oauth2/{rs_name}/_image handlers call validate_image() on the uploaded body before the ACL check that restricts image upload

📡 GitHub-Advisory · 2026-05-06 GHSA-r5fr-9gmv-jggh - scim_proton and kanidm_proto have an authenticated process abort via SCIM filter GHSA-r5fr-9gmv-jggh HIGH rust/scim_proto CVE: Summary A single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a few thousand nested parentheses (≈ 4–12 KB) drives the recursive-descent

📡 GitHub-Advisory · 2026-05-06 GHSA-53hj-r94p-8c8f - Kanidm has non-constant-time comparison of OAuth2 client_secret GHSA-53hj-r94p-8c8f LOW rust/kanidm CVE: Summary The kanidmd OAuth2 token-exchange (/oauth2/token) and token-introspection (/oauth2/token/introspect) endpoints compare the supplied client_secret against the stored secret using Rust's PartialEq on String, which short-circuits on the

📡 GitHub-Advisory · 2026-05-06 GHSA-gpxg-fx2g-qxj2 - Kanidm: Stored HTML injection in "passkey-enrolment" partial via displayname → h GHSA-gpxg-fx2g-qxj2 MEDIUM rust/kanidm CVE: Summary The kanidmd web UI renders the WebAuthn passkey-registration challenge as raw JSON inside an inline <script id="data"> element using the Askama |safe filter.

📡 GitHub-Advisory · 2026-05-06 GHSA-22w3-693w-x895 - webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible GHSA-22w3-693w-x895 LOW rust/webauthn-rs-core CVE: Summary webauthn-rs-core ([Relying Party][rp]) and webauthn-authenticator-rs ([client][]) checked that [an Origin in CollectedClientData][origin] is valid for [an RP ID][rpid] with [str::ends_with()][ends-with], [without checking for a dot (.) before the RP

📡 GitHub-Advisory · 2026-05-06 CVE-2026-44425 - ShellHub has crash-DoS via field injection in filter and sort-by parameters CVE-2026-44425 GHSA-47r2-v3x6-wff9 MEDIUM go/github.com/shellhub-io/shellhub CVE: CVE-2026-44425 Summary The device list endpoint accepts user-controlled identifiers in two places that are passed directly as BSON/SQL keys in the database layer without validation:

📡 GitHub-Advisory · 2026-05-06 GHSA-cqmh-pcgr-q42f - @axonflow/openclaw fix introduces plugin cache and credential-file permission ha GHSA-cqmh-pcgr-q42f MEDIUM npm/@axonflow/openclaw CVE: Summary Two related permission defects in this AxonFlow plugin allowed registration credentials and cache state to be readable by other local users on hosts where the calling user's

📡 GitHub-Advisory · 2026-05-06 CVE-2026-44423 - ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH se CVE-2026-44423 GHSA-9w9c-9w8m-w89q MEDIUM go/github.com/shellhub-io/shellhub CVE: CVE-2026-44423 Summary GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the caller's tenant. An

📡 GitHub-Advisory · 2026-05-06 CVE-2026-44424 - ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device CVE-2026-44424 GHSA-j72x-xfwg-783f MEDIUM go/github.com/shellhub-io/shellhub CVE: CVE-2026-44424 Summary GET /api/devices/:uid returns the full device object whenever the caller is authenticated, without verifying that the device belongs to the caller&

📡 GitHub-Advisory · 2026-05-06 GHSA-248h-974q-xrc2 - axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, pr GHSA-248h-974q-xrc2 MEDIUM maven/com.getaxonflow:axonflow-sdk CVE: Summary The AxonFlow SDK's WebhookSubscription (or equivalent) type did not expose the HMAC-SHA256 signing key returned by the platform's CreateWebhook endpoint. Without access to the

📡 GitHub-Advisory · 2026-05-06 GHSA-mhc4-qq83-fmrr - axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, prev GHSA-mhc4-qq83-fmrr MEDIUM go/github.com/getaxonflow/axonflow-sdk-go/v5 CVE: Summary The AxonFlow SDK's WebhookSubscription (or equivalent) type did not expose the HMAC-SHA256 signing key returned by the platform's CreateWebhook endpoint. Without access

📡 GitHub-Advisory · 2026-05-06 GHSA-9h64-2846-7x7f - Axonflow fixed bugs by implementing multi-tenant isolation and access-control ha GHSA-9h64-2846-7x7f CRITICAL go/github.com/getaxonflow/axonflow CVE: Summary Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-tenant isolation, access-control, and policy-enforcement defects in the

📡 GitHub-Advisory · 2026-05-06 CVE-2026-42577 - Netty epoll transport denial of service via RST on half-closed TCP connection CVE-2026-42577 GHSA-rwm7-x88c-3g2p HIGH maven/io.netty:netty-transport-native-epoll CVE: CVE-2026-42577 Summary Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that

📡 GitHub-Advisory · 2026-05-06 CVE-2026-0897 - Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petab CVE-2026-0897 GHSA-mgx6-5cf9-rr43 HIGH pip/keras CVE: CVE-2026-0897 Summary Keras’s model loader (KerasFileEditor) unsafely loads user-supplied .keras model files containing HDF5-based weight files without performing any validation on HDF5 dataset metadata. An attacker

📡 GitHub-Advisory · 2026-05-06 CVE-2026-44375 - Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes CVE-2026-44375 GHSA-2cwq-pwfr-wcw3 HIGH nuget/Nerdbank.MessagePack CVE: CVE-2026-44375 Summary Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled

📡 GitHub-Advisory · 2026-05-06 CVE-2026-44374 - Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner da CVE-2026-44374 GHSA-p7g9-rp3g-mgfg MEDIUM npm/@backstage/plugin-catalog-unprocessed-entities-common CVE: CVE-2026-44374 Impact The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownershi

📡 GitHub-Advisory · 2026-05-06 CVE-2026-42845 - Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload fi CVE-2026-42845 GHSA-w4rc-p66m-x6qq HIGH composer/getgrav/grav-plugin-form CVE: CVE-2026-42845 Summary (Tested on Form 9.0.3 released on April, 28th) The Form plugin's file upload handler at user/plugins/form/classes/

📡 GitHub-Advisory · 2026-05-06 CVE-2026-44372 - Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Ru CVE-2026-44372 GHSA-9phm-9p8f-hw5m MEDIUM npm/nitro CVE: CVE-2026-44372 A redirect route rule like: routeRules: { "/legacy/**": { redirect: "/**" } } is intended to rewrite paths within the same host. Before the patch, an attacker