📡 GitHub-Advisory · 2026-05-07 CVE-2026-42786 - Bandit Buffers Unbounded WebSocket Continuation Frames, Allowing Unauthenticated CVE-2026-42786 GHSA-pf94-94m9-536p HIGH erlang/bandit CVE: CVE-2026-42786 Summary A single unauthenticated WebSocket client can exhaust server memory in any Bandit-fronted application that accepts WebSocket connections. The fragmented-message reassembly path appends every Continuation{fin: false} frame's payload

📡 GitHub-Advisory · 2026-05-07 CVE-2026-39804 - Bandit's unbounded WebSocket inflate causes BEAM OOM with a single frame CVE-2026-39804 GHSA-frh3-6pv6-rc8j HIGH erlang/bandit CVE: CVE-2026-39804 Summary When a Bandit-fronted server has explicitly enabled WebSocket permessage-deflate (compress: true), an unauthenticated client can OOM the BEAM with a single ~6 MiB WebSocket frame.

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44544 - gittuf's policy can be rolled back to prior valid versions CVE-2026-44544 GHSA-vxvc-cg7j-rwqj MEDIUM go/github.com/gittuf/gittuf CVE: CVE-2026-44544 Summary An attacker with push access to gittuf's Reference State Log (RSL) can roll back the current policy to any previous policy

📡 GitHub-Advisory · 2026-05-07 GHSA-mmpx-jh39-wrv6 - FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP H GHSA-mmpx-jh39-wrv6 MEDIUM go/github.com/gtsteffaniak/filebrowser CVE: Summary FileBrowser Quantum serves inline SVG files without a Content-Security-Policy header, allowing embedded JavaScript in SVG files to execute when accessed via public share

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44542 - FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitr CVE-2026-44542 GHSA-fwj3-42wh-8673 CRITICAL go/github.com/gtsteffaniak/filebrowser CVE: CVE-2026-44542 **Summary** Attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44283 - etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in CVE-2026-44283 GHSA-x35m-3gp4-4fh5 LOW go/go.etcd.io/etcd/v3 CVE: CVE-2026-44283 Impact _What kind of vulnerability is it? Who is impacted?_ A vulnerability in etcd allows read access via PrevKv, or lease attachment in

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44520 - docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler CVE-2026-44520 GHSA-fqph-j6v6-jvgx MEDIUM pip/docling-graph CVE: CVE-2026-44520 Impact The URLInputHandler class in docling_graph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local

📡 GitHub-Advisory · 2026-05-07 GHSA-w5p8-4jcx-2j6r - imageproc: integer overflow in kernel size check leads to out-of-bounds read GHSA-w5p8-4jcx-2j6r MEDIUM rust/imageproc CVE: A bounds verification of a slice storage of a 2-dimensional matrix's coefficients (a kernel) would compare the total size against the product of individual dimensions. This would erroneously

📡 GitHub-Advisory · 2026-05-07 GHSA-qg8r-f7x3-25f7 - imageproc: Out-of-bounds read via NaN coordinates in bilinear/bicubic sampling GHSA-qg8r-f7x3-25f7 MEDIUM rust/imageproc CVE: A bounds check was performed in floating points before a cast to the index passed to an unchecked access function. This checked considered NaN cases improperly, causing them to succeed the

📡 GitHub-Advisory · 2026-05-07 GHSA-5qv7-j6w5-fr4m - imageproc has fragile bounds check when sampling from image GHSA-5qv7-j6w5-fr4m MEDIUM rust/imageproc CVE: A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44426 - ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypa CVE-2026-44426 GHSA-vwx9-7qcf-gg7f MEDIUM go/github.com/shellhub-io/shellhub CVE: CVE-2026-44426 Summary GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e-mails, roles), settings, and device counts — to

📡 GitHub-Advisory · 2026-05-07 GHSA-q2qq-hmj6-3wpp - hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) CVE-2024-8508 GHSA-q2qq-hmj6-3wpp MEDIUM rust/hickory-proto CVE: During message encoding, hickory-proto's BinEncoder stores pointers to labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>. The

📡 GitHub-Advisory · 2026-05-07 GHSA-3v94-mw7p-v465 - hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on GHSA-3v94-mw7p-v465 HIGH rust/hickory-proto CVE: The NSEC3 closest-encloser proof validation in hickory-proto's (0.25.0-alpha.3 ... 0.25.2) and hickory-net's (0.26.0-alpha.1 .. 0.26.0) DnssecDnsHandle walks from the QNAME

📡 GitHub-Advisory · 2026-05-07 GHSA-258c-965c-p3hc - Daptin's Session Management Vulnerability Leads to Insufficient Session Expirati GHSA-258c-965c-p3hc MEDIUM go/github.com/daptin/daptin CVE: Summary A session invalidation vulnerability exists in daptin's authentication system where JSON Web Tokens (JWTs) remain fully valid after a user changes their password. The

📡 GitHub-Advisory · 2026-05-07 GHSA-m38g-vww2-mvgx - Talos Linux has a local privilege escalation from untrusted workloads CVE-2026-31431 GHSA-m38g-vww2-mvgx HIGH go/github.com/siderolabs/talos CVE: Summary A vulnerability in the Linux kernel's algif_aead subsystem (CVE-2026-31431, "copy.fail") allows an unprivileged container workload to corrupt arbitrary file page-cache

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44514 - Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read CVE-2026-44514 GHSA-v8j7-hp7c-738f MEDIUM go/github.com/kubetail-org/kubetail/modules/dashboard CVE: CVE-2026-44514 Summary Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate the Origin header on connection upgrade. A malicious web

📡 GitHub-Advisory · 2026-05-07 GHSA-j7w6-vpvq-j3gm - Diffusers: None.py has Trust Remote Code Bypass GHSA-j7w6-vpvq-j3gm HIGH pip/diffusers CVE: Background This vulnerability is found in the DiffusionPipeline.from_pretrained flow, which is used to load a pipeline from the HuggingFace Hub. This function accepts an optional custom_pipeline keyword argument: the name

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44511 - katalyst-koi: Session cookies can be replayed after user logout CVE-2026-44511 GHSA-4cx3-3c38-j9vv HIGH rubygems/katalyst-koi CVE: CVE-2026-44511 Impact Admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after

📡 GitHub-Advisory · 2026-05-07 CVE-2026-42459 - Free5GC UDM has Improper Input Validation and Generation of Error Messages Conta CVE-2026-42459 GHSA-585v-hcgf-jhfr HIGH go/github.com/free5gc/udm CVE: CVE-2026-42459 Summary The free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm (Subscriber Data Management) service. An

📡 GitHub-Advisory · 2026-05-07 CVE-2026-42328 - go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth CVE-2026-42328 GHSA-w239-58x2-q8p5 MEDIUM go/github.com/ipld/go-ipld-prime CVE: CVE-2026-42328 The DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44312 - CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS CVE-2026-44312 GHSA-ff6c-w6qf-7xqc MEDIUM rubygems/css_parser CVE: CVE-2026-44312 Summary The CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS.

📡 GitHub-Advisory · 2026-05-07 CVE-2026-42083 - Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows ac CVE-2026-42083 GHSA-6rgm-gr97-x3j5 HIGH go/github.com/free5gc/pcf CVE: CVE-2026-42083 Summary PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI Details In NewServer(), the smPolicyGroup route group

📡 GitHub-Advisory · 2026-05-07 CVE-2026-42082 - Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover CVE-2026-42082 GHSA-vrrx-58h3-prmh LOW go/github.com/free5gc/amf CVE: CVE-2026-42082 Summary The AMF in Free5GC v4.2.1 does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.

📡 GitHub-Advisory · 2026-05-07 GHSA-fpf5-4jw8-67x8 - rust-zserio has Unbounded Memory Allocation GHSA-fpf5-4jw8-67x8 HIGH rust/rust-zserio CVE: Impact When deserializing arrays, strings or bytes (blob) types zserio first reads the size of the variable, and then allocates sufficient memory to load data. Since the size is always trusted this can be abused by

📡 GitHub-Advisory · 2026-05-07 CVE-2026-42081 - Free5GC AMF Bypasses UE Security Capabilities on NGAP PathSwitchRequest CVE-2026-42081 GHSA-77x9-rf64-92gv MEDIUM go/github.com/free5gc/amf CVE: CVE-2026-42081 Summary The AMF in Free5GC v4.2.1 does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values, as mandated