Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 6.1 CVE-2026-53766

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots_CVE-2026-53766

Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, McpCont...

ChromeDevTools chrome-devtools-mcp >= 0.24.0, < 1.1.0 CVE
MEDIUM 6.1 CVE-2026-53765

chrome-devtools-mcp: daemon.pid write follows symlinks in /tmp fallback runtime directory_CVE-2026-53765

Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.20.0 until 1.1.0, The chr...

ChromeDevTools chrome-devtools-mcp >= 0.20.0, < 1.1.0 CVE
MEDIUM 6.5 CVE-2026-10642

Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control_CVE-2026-10642

The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable() that repeatedly invokes the...

zephyrproject zephyr 4.1.0 CVE
MEDIUM 5.3 CVE-2026-53949

Ghost Content API filter bypass reveals private fields_CVE-2026-53949

Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be part...

TryGhost Ghost >= 5.46.1, < 6.21.2 CVE
MEDIUM 5.4 CVE-2026-53948

Ghost: File Upload Content-Type Spoofing_CVE-2026-53948

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admi...

TryGhost Ghost >= 6.19.4, < 6.21.1 CVE
MEDIUM 5.3 CVE-2026-53947

Ghost: Member existence leak via magic link sign-in response_CVE-2026-53947

Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possib...

TryGhost Ghost >= 5.18.0, < 6.21.1 CVE
MEDIUM 5.4 CVE-2026-53946

Ghost: Mobiledoc image-size fetch SSRF_CVE-2026-53946

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by is...

TryGhost Ghost >= 6.19.4, < 6.21.1 CVE
MEDIUM 4 CVE-2026-53945

Ghost: Server-side request forgery via DNS rebinding in external request handling_CVE-2026-53945

Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for outbound HTTP requests could be bypassed via DN...

TryGhost Ghost >= 6.0.9, < 6.21.1 CVE
MEDIUM 5.8 CVE-2026-53944

Ghost: Private IP filtering bypass to make server-side requests to internal services_CVE-2026-53944

Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filter that...

TryGhost Ghost >= 6.0.9, < 6.21.1 CVE
MEDIUM 5.7 CVE-2026-49220

Jellyfin: Potential XSS in user management_CVE-2026-49220

Jellyfin is an open source self hosted media server. Prior to 10.11.9, a potential XSS attack exists in Jellyfin which can allow a non-privileged u...

jellyfin jellyfin < 10.11.9 CVE