📰 Dev.to · CVE Reports

CVE-2026-86062: CVE-2026-86062: Stored Cross-Site Scripting (XSS) in HKUDS LightRAG WebUI Chat Renderer

CVE-2026-63349: CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module

CVE-2026-81505: CVE-2026-81505: Broken Object Level Authorization (BOLA) in Convoy Webhook Source Retrieval

CVE-2026-61594: CVE-2026-61594: Authorization Bypass on WebSocket and SSE Mount Paths in djust

CVE-2026-73089: CVE-2026-73089: Unbounded Memory Growth and Denial of Service in browserslist

CVE-2026-54356: CVE-2026-54356: Missing Authorization in Budibase leading to Arbitrary S3 Upload URL Generation

CVE-2026-54548: CVE-2026-54548: Persistent SSH Host Key Checking Disablement in Siemens kas

CVE-2026-54590: CVE-2026-54590: Path Traversal and Authentication Bypass in AsyncSSH via Username Token Substitution

CVE-2026-54591: CVE-2026-54591: Arbitrary File Overwrite via Path Traversal in AsyncSSH SCP Implementation

CVE-2026-48854: CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server

CVE-2026-45019: CVE-2026-45019: Server-Side Request Forgery (SSRF) in Chainlit MCP Endpoint

CVE-2026-61539: CVE-2026-61539: Remote Code Execution via Llama3 Tool Parser Eval Injection in Xinference

GHSA-8HGV-XC77-JMCR: GHSA-8HGV-XC77-JMCR: Privilege Escalation to Super-Admin via Twig Sandbox Escape and Stored XSS in Grav CMS Assets

GHSA-8CFW-PCWH-V63W: GHSA-8CFW-PCWH-V63W: Authenticated Twig Sandbox Escape and Remote Code Execution in Winter CMS

CVE-2026-59995: CVE-2026-59995: Relative Path Traversal in OpenSSH sftp Client

GHSA-FM29-4MQ3-PHG6: GHSA-FM29-4MQ3-PHG6: Missing Authorization in Winter CMS ImportExportController Behavior

GHSA-5CWR-5JXG-PCF6: GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles

CVE-2026-71303: CVE-2026-71303: Server-Side Request Forgery Bypass in Netflix Lemur Authority Updates

CVE-2026-71308: CVE-2026-71308: Missing Authorization and Lifecycle Hijacking in Netflix Lemur

CVE-2026-71557: CVE-2026-71557: Path Traversal and Configuration Overwrite in go-git Filesystem Storage Engine

GHSA-7C4V-FWGW-9RF7: GHSA-7c4v-fwgw-9rf7: Nuxt Dev Server Discloses Project Root and Workspace UUID via Chrome DevTools Endpoint

CVE-2026-63222: CVE-2026-63222: Remote Code Execution via Path Traversal in CodeIgniter4 File Upload Handler

CVE-2026-67422: CVE-2026-67422: Regular Expression Denial of Service in pymdown-extensions

CVE-2026-71849: CVE-2026-71849: Information Exposure via Hop-by-Hop Header Leakage in Hono Proxy Helper