📡 GitHub-Advisory · 2026-05-07 CVE-2026-27964 - FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Man CVE-2026-27964 GHSA-gq5c-rw37-g46c LOW composer/facturascripts/facturascripts CVE: CVE-2026-27964 Summary A Reflected Cross-Site Scripting (XSS) vulnerability exists in the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization. Details

📡 GitHub-Advisory · 2026-05-07 CVE-2026-27891 - FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin CVE-2026-27891 GHSA-3pgc-xqg9-cfr6 HIGH composer/facturascripts/facturascripts CVE: CVE-2026-27891 Summary A Critical vulnerability exists in the Plugins::add() function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an

📡 GitHub-Advisory · 2026-05-07 GHSA-54pg-9963-v8vg - Compromised version of intercom-client published to npm GHSA-54pg-9963-v8vg CRITICAL npm/intercom-client CVE: Impact On April 30, 2026, version 7.0.4 of intercom-client was published to npm using credentials obtained from a compromised developer account. This version was not produced by Intercom's build pipeline.

📡 GitHub-Advisory · 2026-05-07 GHSA-gr3r-crp5-qrrm - Compromised tag of intercom-php published via GitHub GHSA-gr3r-crp5-qrrm CRITICAL composer/intercom/intercom-php CVE: Impact On April 30, 2026, a malicious commit was pushed to the intercom/intercom-php repository and tagged as version 5.0.2, using a compromised service account (github-management-service). This occurred as part of

📡 GitHub-Advisory · 2026-05-07 CVE-2026-42553 - Cinny vulnerable to access token disclosure via invalidated emoji pack avatar UR CVE-2026-42553 GHSA-j944-w549-3453 HIGH npm/cinny CVE: CVE-2026-42553 Impact A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes (for example in a DM) can cause the

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44513 - Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custo CVE-2026-44513 GHSA-98h9-4798-4q5v HIGH pip/diffusers CVE: CVE-2026-44513 Impact A trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it,

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44248 - Netty MQTT: Resource exhaustion in MqttDecoder CVE-2026-44248 GHSA-jfg9-48mv-9qgx MEDIUM maven/io.netty:netty-codec-mqtt CVE: CVE-2026-44248 Impact The MQTT 5 header Properties section is parsed and buffered _before_ any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44007 - vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and CVE-2026-44007 GHSA-8hg8-63c5-gwmx CRITICAL npm/vm2 CVE: CVE-2026-44007 Summary When a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require:

📡 GitHub-Advisory · 2026-05-07 CVE-2026-43998 - vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox e CVE-2026-43998 GHSA-cp6g-6699-wx9c HIGH npm/vm2 CVE: CVE-2026-43998 Summary NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44003 - vm2's Transformer Fast-Path Bypass Exposes Internal State Variable CVE-2026-44003 GHSA-wp5r-2gw5-m7q7 MEDIUM npm/vm2 CVE: CVE-2026-44003 Summary vm2's code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44002 - vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak CVE-2026-44002 GHSA-v27g-jcqj-v8rw MEDIUM npm/vm2 CVE: CVE-2026-44002 Summary vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44000 - vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary CVE-2026-44000 GHSA-mpf8-4hx2-7cjg MEDIUM npm/vm2 CVE: CVE-2026-44000 Summary A sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44004 - vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memor CVE-2026-44004 GHSA-6785-pvv7-mvg7 HIGH npm/vm2 CVE: CVE-2026-44004 Summary Sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C+

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44001 - vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Cr CVE-2026-44001 GHSA-hw58-p9xv-2mjh HIGH npm/vm2 CVE: CVE-2026-44001 Summary A sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that

📡 GitHub-Advisory · 2026-05-07 CVE-2026-43999 - vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` CVE-2026-43999 GHSA-947f-4v7f-x2v8 CRITICAL npm/vm2 CVE: CVE-2026-43999 Summary NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44005 - vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape CVE-2026-44005 GHSA-vwrp-x96c-mhwq CRITICAL npm/vm2 CVE: CVE-2026-44005 Summary vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44006 - vm2 has a Sandbox Escape Vulnerability CVE-2026-44006 GHSA-qcp4-v2jj-fjx8 CRITICAL npm/vm2 CVE: CVE-2026-44006 Summary It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes Details https://github.com/patriksimek/vm2/blob/408fc855f1cc1bbc2985b029465ee0e732ada433/lib/bridge.js#L655-L658 BaseHandler can be reached via

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44662 - rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wra CVE-2026-44662 GHSA-xv59-967r-8726 MEDIUM rust/openssl CVE: CVE-2026-44662 CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad)

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44661 - utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in H CVE-2026-44661 GHSA-39j6-4867-gg4w MEDIUM pip/utcp-http CVE: CVE-2026-44661 Summary The utcp-http plugin is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation. register_manual() validates

📡 GitHub-Advisory · 2026-05-07 GHSA-v7qw-hx66-4w9x - netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow t GHSA-v7qw-hx66-4w9x HIGH pip/netbox-data-flows CVE: Summary An authenticated user who can create or edit ObjectAlias objects can store arbitrary HTML/JavaScript in an alias name. That payload is later rendered unescaped in DataFlow table views,

📡 GitHub-Advisory · 2026-05-07 GHSA-j7h9-2jh7-g967 - mcp-ssh-tool has file transfer path policy bypass and bearer token comparison ha GHSA-j7h9-2jh7-g967 HIGH npm/mcp-ssh-tool CVE: Summary mcp-ssh-tool has released version 2.1.1 with security hardening for transfer path authorization and HTTP bearer authentication. The release addresses: * insufficient local path policy enforcement in transfer-related

📡 GitHub-Advisory · 2026-05-07 CVE-2026-44641 - Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbi CVE-2026-44641 GHSA-xhrw-5qxx-jpwr HIGH pip/apm-cli CVE: CVE-2026-44641 Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks

📡 GitHub-Advisory · 2026-05-07 GHSA-fpw6-hrg5-q5x5 - ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete d GHSA-fpw6-hrg5-q5x5 HIGH go/github.com/lin-snow/Ech0 CVE: Summary Access tokens created with the "never expire" option have no exp JWT claim. Three independent revocation mechanisms fail for this

📡 GitHub-Advisory · 2026-05-07 GHSA-p64j-f4x9-wq66 - Ech0's OAuth redirect URI validation ignores path component, enables exchange-co GHSA-p64j-f4x9-wq66 HIGH go/github.com/lin-snow/Ech0 CVE: Summary parseAndValidateClientRedirect at internal/service/auth/auth.go:448 validates OAuth client-redirect URIs by comparing only scheme and host against the admin-configured allowlist. Path, query, and

📡 GitHub-Advisory · 2026-05-07 GHSA-8mc6-xjpr-h98x - Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnect GHSA-8mc6-xjpr-h98x HIGH go/github.com/lin-snow/ech0 CVE: Summary The fetchPeerConnectInfo function in internal/service/connect/connect.go:214-239 uses httpUtil.SendRequest (no SSRF protection) instead of SendSafeRequest (which has ValidatePublicHTTPURL with private IP blocking). This