Disclosures
10 advisories from 8 writeups, each reported privately and published after the fix shipped.
| Advisory | |||
|---|---|---|---|
| 2026-10-13 | toml (npm) Quadratic-complexity DoS | GHSA-9j65-hcg3-gc64 | High fixed in 5.0.1 |
| 2026-10-08 | Trigger.dev Tenant filter bypass | GHSA-m79r-84cc-xwg9 | CVSS 6.5 fixed in 4.7.3 |
| 2026-10-05 | FacturaScripts Path traversal (CWE-22) | GHSA-grw9-xvv2-5623 | CVSS 9.9 fixed in 2026.7 |
| 2026-10-05 | FacturaScripts Predictable Deploy token (CWE-330) | GHSA-jrgg-j699-qm3h | CVSS 7.5 fixed in 2026.7 |
| 2026-09-26 | mcp-from-openapi SSRF via DNS rebinding | GHSA-rm2m-wfw5-7wp5 | — fixed in 2.5.1 |
| 2026-09-23 | @jhb.software/payload-alt-text-plugin Authorization bypass (CWE-863) | GHSA-3pmw-vxv3-8vgq | CVSS 4.3 fixed in 0.13.0 |
| 2026-09-13 | @argos-ci/core Tokens in debug logs (CWE-532) | GHSA-28pg-v3hp-9g7f | CVSS 6.8 fixed in 6.8.5 |
| 2026-09-13 | @argos-ci/cli ANSI injection (CWE-117) | GHSA-q9j4-4h4j-mv5m | CVSS 1.7 fixed in 6.9.4 |
| 2026-08-17 | Kimai Missing authorization | GHSA-pvc4-crg3-gj44 CVE-2026-80194 | Low (vendor) fixed in 2.64.0 |
| 2026-07-07 | Kimai Mass assignment (CWE-915) | No advisory ID | CVSS 4.3 fixed in 2.57.0 |