Advisories

Disclosure ledger

Security issues our AI Penetration Tester discovered in the world’s most audited code, responsibly disclosed to maintainers.

Critical5

High17

Moderate50

Low3

75 entries

Project	CVEs	Finding	Severity	CVSS	Published
Budibase/budibase	GHSA-pmpg-2mxq-6xwr	Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete	High	7.1	24/07/2026
Admidio/admidio	CVE-2026-53760	Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests	Moderate	5.2	09/07/2026
froxlor/froxlor	GHSA-mr9h-45p9-fg8h	Froxlor: Authenticated customers can read other customers' allowed sender aliases	Moderate	4.3	02/07/2026
Budibase/budibase	CVE-2026-48153	Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata	High	8.5	22/06/2026
Budibase/budibase	CVE-2026-48150	Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign	Critical	9.0	12/06/2026
frangoteam/FUXA	CVE-2026-47721	FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions	Moderate	6.3	08/06/2026
frangoteam/FUXA	CVE-2026-47720	FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString	Moderate	5.3	08/06/2026
frangoteam/FUXA	CVE-2026-47719	FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading	High	8.2	08/06/2026
remix-run/react-router	CVE-2026-42342	React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint	High	7.5	03/06/2026
getkirby/kirby	CVE-2026-44176	Kirby CMS's `pages.access` permission is not checked during rendering of page drafts	Moderate	6.0	26/05/2026
openziti/zrok	CVE-2026-45576	zrok copy writes attacker-controlled WebDAV paths outside the destination root	High	8.3	19/05/2026
openziti/zrok	CVE-2026-45568	rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths	Critical	9.9	19/05/2026
WeblateOrg/weblate	CVE-2026-45106	Weblate: Stored HTML injection in editor search preview	Moderate	4.6	15/05/2026
pyload/pyload	CVE-2026-45348	pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal	High	8.7	14/05/2026
lin-snow/Ech0	GHSA-fpw6-hrg5-q5x5	ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI	High	7.4	07/05/2026
lin-snow/Ech0	GHSA-p64j-f4x9-wq66	Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft	High	8.0	07/05/2026
lin-snow/Ech0	GHSA-pj6q-4vq4-r8cg	Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count	Moderate	6.5	07/05/2026
lin-snow/Ech0	GHSA-3v85-fqvh-7rxf	Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers	Moderate	4.8	07/05/2026
lin-snow/Ech0	GHSA-rj4g-rqgh-rx9h	Ech0 comment model's Email field returned on public /api/comments endpoints	Moderate	5.3	07/05/2026
gotenberg/gotenberg	CVE-2026-42597	Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme	Moderate	5.9	07/05/2026
gotenberg/gotenberg	CVE-2026-42594	Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine	High	7.5	07/05/2026
gotenberg/gotenberg	CVE-2026-42593	Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes	Moderate	5.3	07/05/2026
gotenberg/gotenberg	CVE-2026-42592	Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes	Moderate	5.3	07/05/2026
LemmyNet/lemmy	GHSA-qxrw-f6fh-34r7	Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users	Moderate	5.5	06/05/2026
LemmyNet/lemmy	GHSA-95q8-x6r6-672m	Lemmy may expose private community data through community, saved, liked, and modlog API views	Moderate	5.3	06/05/2026

Show

Page 1 of 3

What CVEs could hide inside your project?What CVEs could hide inside your project?

Use the world’s best AI Penetration Tester yourself to scan your application and hunt down all the security issues

Start a Pentest Contact sales