Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 6.9 CVE-2026-54533

vantage6 node has an Improper Access Control issue_CVE-2026-54533

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms can potentially access othe...

vantage6 vantage6 < 5.0.0 CVE
MEDIUM 6.9 CVE-2026-54445

Vantage6: Set admin user and password from environment or configuration_CVE-2026-54445

vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and...

vantage6 vantage6 < 5.0.0 CVE
MEDIUM 4.7 CVE-2026-50267

Steeltoe: TLS private keys written to /tmp with default permissions, never deleted_CVE-2026-50267

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configurat...

SteeltoeOSS Steeltoe.Configuration.Abstractions >= 4.0.0, < 4.2.0 CVE
MEDIUM 5.9 CVE-2026-50202

Steeltoe’s static JWKS cache shared across schemes and never invalidated_CVE-2026-50202

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Security.A...

SteeltoeOSS Steeltoe.Security.Authentication.CloudFoundryBase < 3.4.0 CVE
MEDIUM 6.5 CVE-2026-50201

Steeltoe’s sensitive actuators (heapdump/env) only require Restricted permission_CVE-2026-50201

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management...

SteeltoeOSS Steeltoe.Management.Endpoint < 4.2.0 CVE
MEDIUM 5.3 CVE-2026-44646

LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`_CVE-2026-44646

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, Context.spawn() creates a ...

harttle liquidjs < 10.26.0 CVE
MEDIUM 6.5 CVE-2026-44645

LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body_CVE-2026-44645

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the renderLimit option can...

harttle liquidjs < 10.26.0 CVE
MEDIUM 6.1 CVE-2026-44644

LiquidJS’s strip_html filter bypass via newline characters in HTML tags enables XSS_CVE-2026-44644

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 10.25.7 and below are vulnerable to XSS through ...

harttle liquidjs < 10.26.0 CVE
MEDIUM 6.5 CVE-2026-12568

Arbitrary File Write in postman_download module_CVE-2026-12568

The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a mal...

Black Lantern Security BBOT 2.1.0 CVE
MEDIUM 5.3 CVE-2026-12565

Path Traversal (Zip-Slip) in unarchive module_CVE-2026-12565

The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behav...

Black Lantern Security BBOT 2.3.1 CVE