langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried acros…

▾ Twilightlangchain-ai · langgraph-apiEPSS 0.37%via CVEORG

CVE-2026-118258Low· 3.7

1w ago

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

▾ Sunliti18next-http-backend · i18next-http-backendvia GHSA

GHSA-jf75-q64q-g65rMedium· 6.5

1w ago

Waline login accepts a non-string email as a match-all MongoDB query

▾ Sunlitwaline · @waline/vercelvia GHSA

GHSA-473q-m89c-ghf8Medium

1w ago

MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)

▾ SunlitMySqlConnector · MySqlConnectorvia GHSA

CVE-2026-55458Low

1w ago

Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

▾ Sunlitcaddyserver · github.com/caddyserver/caddy/v2via OSV

CVE-2026-58273High· 8.8

1w ago

rucio has an Authorization Bypass on REST API endpoint for signing URLs

▾ Twilightrucio · ruciovia OSV

GHSA-7w82-6f9j-v9jpHigh· 7.5

1w ago

mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

▾ Twilightmcp-sanitizer · mcp-sanitizervia GHSA

GHSA-4mfg-r38w-w8fgHigh· 8.2

1w ago

mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6

▾ Twilightmcp-sanitizer · mcp-sanitizervia GHSA

CVE-2026-118651Medium· 5.3

1w ago

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make…

▾ Sunlitlabstack · echoEPSS 0.21%via CVEORG

CVE-2026-118653Medium· 5.3

1w ago

Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

▾ Sunlitlabstack · github.com/labstack/echo/v5EPSS 0.41%via OSV

CVE-2026-118266Medium· 5.3

1w ago

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

▾ Sunlitlabstack · github.com/labstack/echo/v5EPSS 0.16%via OSV

CVE-2026-118652Medium· 6.1

1w ago

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

▾ Sunlitlabstack · github.com/labstack/echo/v5EPSS 0.24%via OSV

CVE-2026-118650High· 7.5

1w ago

Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

▾ Twilightlabstack · github.com/labstack/echo/v5EPSS 0.40%via OSV

CVE-2026-118253High· 8.4

1w ago

Highcharts Dashboards: fullscreen labels are parsed as HTML

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards langua…

▾ Twilighthighcharts · highchartsEPSS 0.42%via CVEORG

CVE-2026-118255High

1w ago

Echo: Decompress permits unbounded gzip expansion in v4

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a han…

▾ Twilightlabstack · echoEPSS 0.37%via CVEORG

CVE-2026-118265Medium· 5.3

1w ago

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Ech…

▾ Sunlitlabstack · echoEPSS 0.14%via CVEORG

CVE-2026-116795High· 7.5

1w ago

RE2JS: Quadratic-time denial of service in re2js lookbehind matching

▾ Twilightre2js · re2jsvia GHSA

CVE-2026-116796High· 7.2

1w ago

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker…

▾ Twilighthighcharts · highchartsEPSS 0.34%via CVEORG

CVE-2026-116797High· 8.5

1w ago

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

▾ Twilighthighcharts · @highcharts/grid-provia GHSA

CVE-2026-118242High· 8.5

1w ago

Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

▾ Twilighthighcharts · @highcharts/grid-litevia GHSA

CVE-2026-118243Medium· 5.3

1w ago

Highcharts Dashboards: `proto` data table id writes sync listeners to `Object.prototype`

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`

▾ Sunlithighcharts · @highcharts/dashboardsvia GHSA

Tagged “ghsa”

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local u…

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end …

LangGraph JavaScript custom authentication may permit cross-user Store access

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Waline login accepts a non-string email as a match-all MongoDB query

MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)

Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

rucio has an Authorization Bypass on REST API endpoint for signing URLs

mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Highcharts Dashboards: fullscreen labels are parsed as HTML

Highcharts Grid: `javascript:` URL in credits.href runs script on click

Highcharts Grid parses pagination language options as HTML

Highcharts Dashboards parses sidebar component labels as HTML

Highcharts: `javascript:` URL in credits.href runs script on click

Echo: Decompress permits unbounded gzip expansion in v4

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

RE2JS: Quadratic-time denial of service in re2js lookbehind matching

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`

Highcharts Dashboards: `proto` data table id writes sync listeners to `Object.prototype`