Recent Advisories

Severity ID Title Vendor Product Date Type
HIGH 7.7 CVE-2026-54033

LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs_CVE-2026-54033

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-c...

danny-avila LibreChat < 0.8.4-rc1 CVE
HIGH 8 CVE-2026-54030

LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow_CVE-2026-54030

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implementation does not validate ...

danny-avila LibreChat < 0.8.5 CVE
HIGH 7.2 CVE-2026-45233

HTMLy CMS 3.1.1 Path Traversal via oldfile Parameter in Autosave_CVE-2026-45233

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by s...

danpros htmly CVE
HIGH 7.5 CVE-2026-13351

net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets_CVE-2026-13351

Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragment...

zephyrproject-rtos Zephyr * CVE
HIGH 8.2 CVE-2026-55961

wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer_CVE-2026-55961

wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos,...

wolfSSL wolfSSL 3.15.7 CVE
HIGH 7.1 CVE-2026-55700

pnpm: stage download writes outside destination via manifest version traversal_CVE-2026-55700

pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and versi...

pnpm pnpm >= 11.3.0, < 11.5.3 CVE
HIGH 8.8 CVE-2026-55698

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes_CVE-2026-55698

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock...

pnpm pnpm < 10.34.2 CVE
HIGH 7.5 CVE-2026-55697

pnpm: Repository-controlled configDependencies can select a pacquet native install engine_CVE-2026-55697

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch...

pnpm pnpm < 10.34.2 CVE
HIGH 7.5 CVE-2026-55487

pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle_CVE-2026-55487

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball,...

pnpm pnpm < 10.34.2 CVE
HIGH 8.8 CVE-2026-50016

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement_CVE-2026-50016

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path tr...

pnpm pnpm < 10.33.4 CVE