📰 Dev.to · CVE Reports

GHSA-42H9-826W-CGV3: GHSA-42H9-826W-CGV3: Denial of Service via Uncontrolled Recursion in Axios formDataToJSON

CVE-2026-48598: CVE-2026-48598: Multipart Part Header Injection and Request Smuggling in elixir-tesla

CVE-2026-54651: CVE-2026-54651: Infinite Loop Vulnerability in pypdf Article Thread Parser

GHSA-382C-VX95-W3P5: GHSA-382C-VX95-W3P5: Missing Access Control on Profile Endpoint and MCP Tool in Gittensory

CVE-2026-48282: CVE-2026-48282: Unauthenticated Path Traversal and Arbitrary File Write in Adobe ColdFusion Remote Development Services

GHSA-CWV4-H3J5-W3CF: GHSA-CWV4-H3J5-W3CF: Stored and Reflected Cross-Site Scripting in rama's Directory Listing Component

GHSA-Q855-8RH5-JFGQ: GHSA-Q855-8RH5-JFGQ: Missing Authentication and CSRF in ha-mcp bare root settings and policy routes

GHSA-F66Q-9RF6-8795: GHSA-f66q-9rf6-8795: WebAuthn Re-authentication Freshness Bypass in Flask-Security-Too

GHSA-86J7-9J95-VPQJ: GHSA-86J7-9J95-VPQJ: Stored Cross-Site Scripting in Better Auth Plugins via Malicious Redirect URIs

GHSA-9H47-PQCX-HJR4: GHSA-9H47-PQCX-HJR4: Insecure Cryptographic Defaults in Better Auth OIDC Provider

GHSA-2VG6-77G8-24MP: GHSA-2vg6-77g8-24mp: Insufficient Session Expiration via Incomplete Cleanup in Better Auth Ecosystem

GHSA-J8V8-G9CX-5QF4: GHSA-J8V8-G9CX-5QF4: Missing Authorization and Access Control Flaw in @better-auth/scim

GHSA-FQF6-GXHH-2XHW: GHSA-FQF6-GXHH-2XHW: Silent Data Loss and Behavioral Mismatch in uutils coreutils Backup Logic

CVE-2025-46571: CVE-2025-46571: Stored Cross-Site Scripting (XSS) in Open WebUI

CVE-2025-46719: CVE-2025-46719: Stored XSS and Administrative RCE in Open WebUI

CVE-2026-26192: CVE-2026-26192: Stored Cross-Site Scripting via Insecure Iframe Sandbox in Open WebUI

CVE-2026-34225: CVE-2026-34225: Blind Server-Side Request Forgery in Open WebUI Image Edit Endpoint

GHSA-VJC7-JRH9-9J86: Unauthenticated CRUD and Sensitive Data Exposure in 9Router API Endpoints

CVE-2026-55790: CVE-2026-55790: DOM-Based Cross-Site Scripting in Craft CMS Support Widget

GHSA-CGFV-JRFP-2R7V: GHSA-cgfv-jrfp-2r7v: Authenticated SQL Injection in OpenRemote Datapoint Crosstab Export

GHSA-QRWJ-VH9X-GW5V: GHSA-QRWJ-VH9X-GW5V: Cross-Agent Server-Side Request Forgery and Remote Code Execution in Coder Workspace Agent

CVE-2026-55792: CVE-2026-55792: Sensitive File Disclosure in Craft CMS via Twig Sandbox Bypass

CVE-2026-56350: CVE-2026-56350: SSO Enforcement Bypass in n8n via API Parameter Pollution / Mass Assignment

CVE-2026-39829: CVE-2026-39829: Denial of Service in Go SSH Parser