📡 GitHub-Advisory · 2026-05-08 CVE-2026-44327 - free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach t CVE-2026-44327 GHSA-cmpj-2x3g-m7g3 CRITICAL go/github.com/free5gc/nef CVE: CVE-2026-44327 Summary free5GC's NEF mounts the nnef-oam route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44326 - free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged b CVE-2026-44326 GHSA-3p28-73q7-45xp CRITICAL go/github.com/free5gc/nef CVE: CVE-2026-44326 Summary free5GC's NEF mounts the 3gpp-traffic-influence API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44325 - free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser v CVE-2026-44325 GHSA-f8qv-7x5w-qr48 HIGH go/github.com/free5gc/nrf CVE: CVE-2026-44325 Summary free5GC's NRF root SBI endpoint POST /oauth2/token contains a parser-level type-confusion bug family. The handler in NFs/nrf/internal/sbi/api_

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44324 - free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via ni CVE-2026-44324 GHSA-jqfc-gwj5-3w63 MEDIUM go/github.com/free5gc/udr CVE: CVE-2026-44324 Summary free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler panics on a single authenticated request against a

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44323 - free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE CVE-2026-44323 GHSA-4rqf-grm6-vf75 MEDIUM go/github.com/free5gc/udr CVE: CVE-2026-44323 Summary free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereference reachable from a single authenticated

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44322 - free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR acces CVE-2026-44322 GHSA-j59f-x285-69jx HIGH go/github.com/free5gc/nef CVE: CVE-2026-44322 Summary free5GC's NEF PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId} handler panics with a nil-pointer dereference when the upstream UDR call

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44321 - free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping CVE-2026-44321 GHSA-44qj-cghf-9p97 HIGH go/github.com/free5gc/smf CVE: CVE-2026-44321 Summary free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware (same root cause as free5gc/free5gc#

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44320 - free5GC's NEF nnef-callback route group is unauthenticated; forged callback requ CVE-2026-44320 GHSA-wqfh-gq79-j8mf HIGH go/github.com/free5gc/nef CVE: CVE-2026-44320 Summary free5GC's NEF mounts the nnef-callback route group without inbound OAuth2/bearer-token authorization. A forged or arbitrary bearer token (e.g. Authorization:

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44318 - free5GC's BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes t CVE-2026-44318 GHSA-27ph-8q4f-h7m7 MEDIUM go/github.com/free5gc/bsf CVE: CVE-2026-44318 Summary free5GC's BSF PUT /nbsf-management/v1/subscriptions/{subId} handler has an unsynchronized write on the global Subscriptions map. The handler first reads

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44317 - free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 w CVE-2026-44317 GHSA-wwqh-7jm5-gj7w MEDIUM go/github.com/free5gc/pcf CVE: CVE-2026-44317 Summary free5GC's PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on a single authenticated request whose ascReqData.suppFeat == "1" (enabling traffic-routing

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44316 - free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/Op CVE-2026-44316 GHSA-wr8j-6chw-gm6p HIGH go/github.com/free5gc/pcf CVE: CVE-2026-44316 Summary free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI consumer call (UDR lookup)

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44315 - free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens c CVE-2026-44315 GHSA-5f62-53r8-qrqf CRITICAL go/github.com/free5gc/nef CVE: CVE-2026-44315 Summary free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44309 - gitsign verify accepts signatures over go-git-normalized bytes, enabling trust c CVE-2026-44309 GHSA-7rmh-48mx-2vwc MEDIUM go/github.com/sigstore/gitsign CVE: CVE-2026-44309 Summary gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44566 - Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal CVE-2026-44566 GHSA-9pgh-j74g-qj6m HIGH pip/open-webui CVE: CVE-2026-44566 **CONFIDENTIAL** KL-CAN-2024-002 Vulnerability Details #FieldValue 1**Discoverer**Jaggar Henry & Sean Segreti of KoreLogic, Inc. 2**Date Submitted**2024.03.12 3**Title**Open WebUI Arbitrary File Upload + Path

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44567 - Open WebUI has Improper Authorization Control CVE-2026-44567 GHSA-4vg5-rp28-gvjf HIGH pip/open-webui CVE: CVE-2026-44567 **CONFIDENTIAL** Vulnerability Disclosure Analysis Documentation Vulnerability Details #FieldValue 1**Discoverer**Taylor Pennington of KoreLogic, Inc. 2**Date Submitted**June 11, 2024 3**Title**Open WebUI Improper Authorization Control 5**Affected Vendor**Open WebUI

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44549 - Open WebUI has stored XSS in Excel file preview CVE-2026-44549 GHSA-jwf8-pv5p-vhmc HIGH pip/open-webui CVE: CVE-2026-44549 Summary Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheet_to_html to embed an XSS

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44832 - Snipe-IT has Privilege Escalation via API Permissions Assignment CVE-2026-44832 GHSA-hq28-crg7-95pr HIGH composer/snipe/snipe-it CVE: CVE-2026-44832 Impact An authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1.

📡 GitHub-Advisory · 2026-05-08 GHSA-pmwq-pjrm-6p5r - in-toto-golang and in-toto-python have inconsistent negation behavior GHSA-pmwq-pjrm-6p5r MEDIUM go/github.com/in-toto/in-toto-golang CVE: Impact _What kind of vulnerability is it? Who is impacted?_ in-toto-golang and in-toto-python both support glob patterns in artifact rules to indicate the artifacts that a rule applies to. Both support

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44831 - Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0) CVE-2026-44831 GHSA-r42m-953q-6vjx MEDIUM composer/snipe/snipe-it CVE: CVE-2026-44831 Impact Users with component view access could be impacted by an unescaped notes column. Patches This was patched in https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438, and

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44298 - Kimai has an arbitrary file read in its invoice PDF renderer (admin) CVE-2026-44298 GHSA-h5fh-7hwr-97mw MEDIUM composer/kimai/kimai CVE: CVE-2026-44298 Summary Users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44568 - Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Applic CVE-2026-44568 GHSA-fq3v-xjjx-95rc MEDIUM pip/open-webui CVE: CVE-2026-44568 Vulnerability Details CWE-79: Cross-site Scripting (XSS) The AccountPending.svelte component renders the admin-configured "Pending User Overlay Content" using marked.parse() inside {@html} with an

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44214 - eventsource-encoder vulnerable to SSE event injection via unsanitized `event` an CVE-2026-44214 GHSA-m9g3-3g99-mhpx MEDIUM npm/eventsource-encoder CVE: CVE-2026-44214 Summary eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44213 - OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy CVE-2026-44213 GHSA-wfr5-454p-mjc2 MEDIUM nuget/OpenTelemetry.Exporter.Instana CVE: CVE-2026-44213 Summary The OpenTelemetry.Exporter.Instana NuGet package does not validate HTTPS/TLS certificates are valid when sending telemetry to a configured Instana back-end when a proxy is

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44247 - Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body si CVE-2026-44247 GHSA-8wxp-xxp2-rcgx MEDIUM go/volcano.sh/volcano CVE: CVE-2026-44247 Impact The Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44211 - Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability CVE-2026-44211 GHSA-5c57-rqjx-35g2 CRITICAL npm/cline CVE: CVE-2026-44211 Summary The kanban npm package (used by the cline CLI) starts a WebSocket server on 127.0.0.1:3484 with no Origin header validation. Any website a developer visits