Recent Advisories

Severity ID Title Vendor Product Date Type
LOW 2.5 CVE-2026-54326

Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass_CVE-2026-54326

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not cons...

earendil-works pi >= 0.74.0, < 0.78.1 CVE
MEDIUM 4.4 CVE-2026-54325

Pi loads project-local extensions without approval_CVE-2026-54325

Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and resources from a repository's .pi directory withou...

earendil-works pi < 0.79.0 CVE
HIGH 7.8 CVE-2026-53622

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts_CVE-2026-53622

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration ...

traefik traefik < 3.7.3 CVE
HIGH 7.8 CVE-2026-48491

Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass_CVE-2026-48491

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting pro...

traefik traefik >= 3.7.0, < 3.7.3 CVE
HIGH 7.8 CVE-2026-48020

Traefik StripPrefix Route-Level Auth Bypass via Path Normalization_CVE-2026-48020

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripP...

traefik traefik >= 3.7.0-ea.1, < 3.7.3 CVE
MEDIUM 6.9 CVE-2026-45792

RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM_CVE-2026-45792

rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.32.0, RTK (Rust Token Killer) improperly trusts project-l...

rtk-ai rtk < 0.32.0 CVE
MEDIUM 6.2 CVE-2026-9073

Foreman-mcp-server: mcp server: insecure sensitive http header sanitization_CVE-2026-9073

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authenticatio...

Red Hat Red Hat Satellite 6 CVE
MEDIUM 6.9 CVE-2026-53931

NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint_CVE-2026-53931

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a ...

nocodb nocodb < 2026.05.1 CVE
MEDIUM 5.1 CVE-2026-53930

NocoDB: Server-Side Request Forgery via Base Migration URL_CVE-2026-53930

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a caller-supplied URL that the ...

nocodb nocodb < 2026.05.1 CVE
MEDIUM 5.1 CVE-2026-53929

NocoDB: Stored Cross-Site Scripting via Secure Attachment_CVE-2026-53929

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, with NC_SECURE_ATTACHMENTS=true, an authenticated uploader could del...

nocodb nocodb < 2026.05.1 CVE