Publish Advisories

GHSA-368x-wmmg-hq5c
GHSA-223g-f5mq-gw33
GHSA-2rgp-f66f-4499
GHSA-3644-q5cj-c5c7
GHSA-8wxp-xxp2-rcgx
GHSA-c38f-wx89-p2xg
GHSA-c6rc-8jpp-2fgc
GHSA-f3jg-756w-gm35
GHSA-g3xq-3gmv-qq8g
GHSA-hvx9-hwr7-wjj9
GHSA-pv5w-4p9q-p3v2
GHSA-qqq4-5773-pmw5
GHSA-r95x-qfjj-fjj2
GHSA-vf3q-frmr-vrr9
GHSA-vrxg-gm77-7q5g
GHSA-xm76-r88j-vm3g
GHSA-qpgp-93vx-g8v8

Author: advisory-database[bot]

advisories/github-reviewed/2023/02/GHSA-368x-wmmg-hq5c/GHSA-368x-wmmg-hq5c.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-368x-wmmg-hq5c",
-  "modified": "2023-02-22T21:58:33Z",
+  "modified": "2026-06-08T23:55:14Z",
   "published": "2023-02-22T21:58:33Z",
   "aliases": [
     "CVE-2023-25570"
   ],
   "summary": "Apollo has potential access control security issue in eureka",
-  "details": "### Impact\nIf users expose the apollo-configservice to the internet (which is not recommended), there are potential security issues since there is no authentication feature enabled for the built-in eureka service. Malicious hackers may access eureka directly to mock apollo-configservice and apollo-adminservice .\n\n### Patches\nLogin authentication for eureka was added in https://github.com/apolloconfig/apollo/pull/4663 and was released in [v2.1.0](https://github.com/apolloconfig/apollo/releases/tag/v2.1.0).\n\n### Workarounds\nTo fix the potential issue without upgrading, simply follow the advice that does not expose apollo-configservice to the internet.\n\n### References\n[Apollo Security Guidence](https://www.apolloconfig.com/#/en/usage/apollo-user-guide?id=_71-security-related)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [issue](https://github.com/apolloconfig/apollo/issues)\n* Email us at [apollo-config@googlegroups.com](mailto:apollo-config@googlegroups.com)\n",
+  "details": "### Impact\nIf users expose the apollo-configservice to the internet(which is not recommended), there are potential security issues since there is no authentication feature enabled for the built-in eureka service. Malicious hackers may access eureka directly to mock apollo-configservice and apollo-adminservice .\n\n### Patches\nLogin authentication for eureka was added in https://github.com/apolloconfig/apollo/pull/4663 and was released in [v2.1.0](https://github.com/apolloconfig/apollo/releases/tag/v2.1.0).\n\n### Workarounds\nTo fix the potential issue without upgrading, simply follow the advice that does not expose apollo-configservice to the internet.\n\n### References\n[Apollo Security Guidence](https://www.apolloconfig.com/#/en/portal/apollo-user-guide?id=_71-security-related)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [issue](https://github.com/apolloconfig/apollo/issues)\n* Email us at [apollo-config@googlegroups.com](mailto:apollo-config@googlegroups.com)",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2026/05/GHSA-223g-f5mq-gw33/GHSA-223g-f5mq-gw33.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-223g-f5mq-gw33",
-  "modified": "2026-05-13T01:39:04Z",
+  "modified": "2026-06-08T23:54:55Z",
   "published": "2026-05-13T01:39:04Z",
   "aliases": [
     "CVE-2026-44720"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-223g-f5mq-gw33"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44720"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/th30d4y/OpenLearnX"
@@ -57,6 +61,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-13T01:39:04Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-27T22:16:36Z"
   }
 }

advisories/github-reviewed/2026/05/GHSA-2rgp-f66f-4499/GHSA-2rgp-f66f-4499.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2rgp-f66f-4499",
-  "modified": "2026-05-13T15:33:24Z",
+  "modified": "2026-06-08T23:55:04Z",
   "published": "2026-05-13T15:33:24Z",
   "aliases": [
     "CVE-2026-45083"
@@ -40,10 +40,18 @@
       "type": "WEB",
       "url": "https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-2rgp-f66f-4499"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45083"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/intranda/goobi-viewer-core/commit/326980f24ce1e7cfabf658dd5f615934ca68ebbd"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/intranda/goobi-viewer-core/commit/6bfb1cbd4250b0b347e84a80f38e8bf46acac705"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/intranda/goobi-viewer-core"
@@ -60,6 +68,6 @@
     "severity": "CRITICAL",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-13T15:33:24Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-27T22:16:36Z"
   }
 }

advisories/github-reviewed/2026/05/GHSA-3644-q5cj-c5c7/GHSA-3644-q5cj-c5c7.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3644-q5cj-c5c7",
-  "modified": "2026-05-13T15:29:30Z",
+  "modified": "2026-06-08T23:54:03Z",
   "published": "2026-05-13T15:29:30Z",
   "aliases": [
     "CVE-2026-45134"
@@ -97,6 +97,10 @@
       "type": "WEB",
       "url": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-3644-q5cj-c5c7"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45134"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/langchain-ai/langsmith-sdk"
@@ -109,6 +113,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-13T15:29:30Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-27T20:16:38Z"
   }
 }

advisories/github-reviewed/2026/05/GHSA-8wxp-xxp2-rcgx/GHSA-8wxp-xxp2-rcgx.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8wxp-xxp2-rcgx",
-  "modified": "2026-05-08T20:44:54Z",
+  "modified": "2026-06-08T23:54:51Z",
   "published": "2026-05-08T20:44:54Z",
   "aliases": [
     "CVE-2026-44247"
@@ -78,6 +78,10 @@
       "type": "WEB",
       "url": "https://github.com/volcano-sh/volcano/security/advisories/GHSA-8wxp-xxp2-rcgx"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44247"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/volcano-sh/volcano"
@@ -91,6 +95,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-08T20:44:54Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-27T22:16:35Z"
   }
 }

advisories/github-reviewed/2026/05/GHSA-c38f-wx89-p2xg/GHSA-c38f-wx89-p2xg.json

@@ -1,14 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-c38f-wx89-p2xg",
-  "modified": "2026-05-12T22:25:11Z",
+  "modified": "2026-06-08T23:53:55Z",
   "published": "2026-05-12T22:25:11Z",
   "aliases": [
     "CVE-2026-44660"
   ],
   "summary": "UltraJSON has a Memory Leak in ujson.dump() on Write Failure",
   "details": "### Summary\n\nWhen `ujson.dump()` writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload.\n\nCode that uses `ujson.dumps()` rather than `ujson.dump()` or only JSON load/decode methods is unaffected.\n\n### Details\n\n**Vulnerability Location:**\n- `src/ujson/python/objToJSON.c:913` - `objToJSONFile()` function start\n- `src/ujson/python/objToJSON.c:931` - Error return on write failure\n- `src/ujson/python/objToJSON.c:942` - Early return without cleanup\n \n**Root Cause:**\n\nThe `objToJSONFile()` function allocates a Python string object via `ujson_dumps_internal()`, calls the file's `write()` method, and returns early if `write()` raises an exception—but never calls `Py_DECREF(string)` on the early exit path.\n\n### PoC\n```python\nimport gc, tracemalloc, ujson\n\nclass BadFile:\n    def write(self, s):\n        raise RuntimeError(\"boom\")\n\nobj = {\"x\": \"A\" * 200000}\n\ndef run():\n    try:\n        ujson.dump(obj, BadFile())\n    except RuntimeError:\n        pass\n\nrun()\ntracemalloc.start()\ngc.collect()\nbase = tracemalloc.get_traced_memory()[0]\n\nfor i in range(5):\n    run()\n    gc.collect()\n    cur = tracemalloc.get_traced_memory()[0]\n    print(i, cur - base)\n```\n\n### Impact\n\nAny application that serializes data through `ujson.dump()` to an attacker-influenced file-like object that can fail can be driven into linear memory growth. An attacker can quickly use up all the memory of say a web server that sends JSON responses using `ujson.dump()` by repeatedly making requests then closing the connection mid response.\n\n### Remediation\n\nThe missing dec-refs were added in 82af1d0ac01d09aa40c887b460d44b9d9f4bccd9. We recommend upgrading to [UltraJSON 5.12.1](https://github.com/ultrajson/ultrajson/releases/tag/5.12.1).\n\n### Workarounds\n\nReplacing `ujson.dump(obj, file)` with `file.write(ujson.dumps(obj))` is equivalent (contrary to popular misconception, there are no streaming benefits to using `ujson.dump()`) and will avoid the memory leak.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
@@ -43,6 +47,10 @@
       "type": "WEB",
       "url": "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44660"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9"
@@ -63,6 +71,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-12T22:25:11Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-27T21:16:17Z"
   }
 }

advisories/github-reviewed/2026/05/GHSA-c6rc-8jpp-2fgc/GHSA-c6rc-8jpp-2fgc.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-c6rc-8jpp-2fgc",
-  "modified": "2026-05-19T16:08:41Z",
+  "modified": "2026-06-08T23:54:37Z",
   "published": "2026-05-13T15:31:49Z",
   "aliases": [
     "CVE-2026-45137"
@@ -44,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/solana-foundation/anchor/security/advisories/GHSA-c6rc-8jpp-2fgc"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45137"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/solana-foundation/anchor"
@@ -64,6 +68,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-13T15:31:49Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-27T21:16:18Z"
   }
 }

advisories/github-reviewed/2026/05/GHSA-f3jg-756w-gm35/GHSA-f3jg-756w-gm35.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f3jg-756w-gm35",
-  "modified": "2026-05-11T21:20:04Z",
+  "modified": "2026-06-08T23:53:33Z",
   "published": "2026-05-11T21:20:04Z",
   "aliases": [
     "CVE-2026-45046"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/safedep/gryph/security/advisories/GHSA-f3jg-756w-gm35"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45046"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/safedep/gryph"
@@ -59,6 +63,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-11T21:20:04Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-27T19:16:21Z"
   }
 }

advisories/github-reviewed/2026/05/GHSA-g3xq-3gmv-qq8g/GHSA-g3xq-3gmv-qq8g.json

@@ -1,14 +1,23 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-g3xq-3gmv-qq8g",
-  "modified": "2026-05-13T15:31:41Z",
+  "modified": "2026-06-08T23:54:32Z",
   "published": "2026-05-13T15:31:41Z",
   "aliases": [
     "CVE-2026-45136"
   ],
   "summary": "claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh",
   "details": "## Summary\n\n`tools/quota-statusline.sh` (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A `'''` byte sequence in any user-controlled field of the payload closes the literal early and lets following bytes execute as Python in the user's Claude Code process.\n\n## Affected versions\n\n- v3.5.0\n- v3.5.1\n\n## Patched versions\n\n- v3.5.2\n\n## Affected configurations\n\nUsers who wired `tools/quota-statusline.sh` into Claude Code's `statusLine` configuration. The v3.5.0 README explicitly recommends this setup, so most users on v3.5.0/v3.5.1 with the recommended setup are affected.\n\n## Attack chain\n\nClaude Code's statusline hook payload reflects user-controlled paths (`cwd`, `workspace.current_dir`, `workspace.project_dir`, `transcript_path`). Apostrophes are legal in POSIX filesystem paths.\n\n1. A hostile directory name containing `'''+payload+'''` lands on disk via any normal vector — `git clone`, archive extraction, npm package, downloaded zip, etc.\n2. The victim has the recommended `tools/quota-statusline.sh` wired into their CC `statusLine` config.\n3. The victim `cd`s anywhere a hostile path is reachable.\n4. CC fires the statusline hook on every redraw. The Python literal closes early. The injected bytes execute as Python in the user's process.\n\n## Severity\n\nLocal code execution at user privilege. Persistent re-fire on every statusline redraw. No user interaction beyond `cd`-ing into the hostile path. The user's shell, CC session, files, SSH keys, and any locally-accessible credentials are reachable from the executed code.\n\n## Vulnerable pattern\n\n```sh\ninput=$(cat)\nresult=$(python3 -c \"\n    stdin_data = json.loads('''$input''') if '''$input''' else {}\n\")\n```\n\n## Fix\n\nCapture stdin in bash, export to env, and pipe the Python source through a single-quoted heredoc (`<<'PYEOF'`). Single-quoting disables ALL bash interpolation inside the body. Python reads the JSON via `os.environ.get('CC_INPUT')`, where the bytes are inert at every layer.\n\n```sh\nCC_INPUT=$(cat)\nexport CC_INPUT\n\npython3 <<'PYEOF' 2>/dev/null\nimport os, json\ntry:\n    cc_input = json.loads(os.environ.get('CC_INPUT') or '{}')\nexcept Exception:\n    cc_input = {}\n# ...\nPYEOF\n```\n\n## Workarounds\n\nUntil upgrading to v3.5.2:\n\n- Disable the statusline by removing the `statusLine` entry from `~/.claude/settings.json`, or\n- Replace `tools/quota-statusline.sh` with a script that does NOT pass stdin through `python3 -c \"...\"` (a heredoc + env var rewrite is safe)\n\n## Credit\n\nReported by Jakob Linke (@schuay) via GitHub issue [#108](https://github.com/cnighswonger/claude-code-cache-fix/issues/108).\n\n## Timeline\n\n- 2026-05-07 — reported (#108)\n- 2026-05-07 — confirmed, fix implemented (#110)\n- 2026-05-07 — v3.5.2 published",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"
+    }
+  ],
   "affected": [
     {
       "package": {
@@ -35,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/cnighswonger/claude-code-cache-fix/security/advisories/GHSA-g3xq-3gmv-qq8g"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45136"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/cnighswonger/claude-code-cache-fix/issues/108"
@@ -60,6 +73,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-13T15:31:41Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-27T21:16:18Z"
   }
 }

advisories/github-reviewed/2026/05/GHSA-hvx9-hwr7-wjj9/GHSA-hvx9-hwr7-wjj9.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hvx9-hwr7-wjj9",
-  "modified": "2026-05-13T15:29:21Z",
+  "modified": "2026-06-08T23:53:59Z",
   "published": "2026-05-13T15:29:21Z",
   "aliases": [
     "CVE-2026-44724"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-hvx9-hwr7-wjj9"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44724"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/sebhildebrandt/systeminformation"
@@ -59,6 +63,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-13T15:29:21Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2026-05-27T20:16:37Z"
   }
 }