CVE-2026-54174 [HIGH 8.3] depth=twilight score=46 — melange: Incomplete package integrity verification allows data section substitution
GHSA-g936-7jqj-mwv8 [CRITICAL 9] depth=midnight score=50 — TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation
CVE-2026-54159 [CRITICAL 10] depth=midnight score=55 — prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
CVE-2026-50551 [CRITICAL 9.9] depth=midnight score=55 epss=0% — SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content
CVE-2026-54163 [MEDIUM 4.7] depth=sunlit score=26 — Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
GHSA-h4g2-xfmw-q2c9 [HIGH] depth=twilight score=41 — Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset
CVE-2026-54171 [MEDIUM 6.5] depth=sunlit score=36 — Excon does not redact additional sensitive/risky headers when following redirects
CVE-2026-54066 [HIGH 7.5] depth=twilight score=42 epss=2% — SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary   file─read), Incomplete fix of CVE-2026-41894 
CVE-2026-54067 [CRITICAL 9.9] depth=midnight score=55 epss=0% — SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()
CVE-2026-54072 [CRITICAL 9.3] depth=midnight score=51 — Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
CVE-2026-54063 [HIGH 7.5] depth=twilight score=41 — Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)
GHSA-9mqm-qcwf-5qhg [MEDIUM 5.5] depth=sunlit score=30 — CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources
CVE-2026-54068 [MEDIUM 5.9] depth=sunlit score=32 epss=0% — SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon
CVE-2026-54069 [CRITICAL] depth=midnight score=52 epss=1% — SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist
CVE-2026-54089 [CRITICAL 9.1] depth=midnight score=50 epss=0% — File Browser: Authentication Bypass via Proxy Auth Header Forgery
CVE-2026-54070 [HIGH 7.1] depth=twilight score=39 epss=0% — SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
CVE-2026-54136 [MEDIUM] depth=sunlit score=28 — Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search
GHSA-99j7-fhr2-xfj4 [CRITICAL] depth=midnight score=52 — `exploration` was removed from crates.io for malicious code
CVE-2026-54088 [CRITICAL] depth=midnight score=52 epss=1% — File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)
CVE-2026-54071 [HIGH 7.8] depth=twilight score=43 — BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
GHSA-qv4m-m73m-8hj7 [HIGH 8.8] depth=twilight score=48 — NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)
GHSA-xrmc-c5cg-rv7x [HIGH 8.8] depth=twilight score=48 — SafeInstall agent guard shell parsing can miss raw package execution
GHSA-wm45-qh3g-v83f [HIGH 7.7] depth=twilight score=42 — mcp-atlassian: Arbitrary server-side file read via attachment upload
GHSA-g5r6-gv6m-f5jv [HIGH 7.7] depth=twilight score=42 — mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment
CVE-2026-54158 [CRITICAL 9.9] depth=midnight score=55 epss=0% — SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()
GHSA-489g-7rxv-6c8q [MEDIUM 6.5] depth=sunlit score=36 — MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
MAL-2026-10139 [NONE] depth=sunlit score=3 — Malicious code in turbocalc (PyPI)
CVE-2026-49865 [MEDIUM] depth=sunlit score=28 — Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs
CVE-2026-49866 [HIGH 7.5] depth=twilight score=41 epss=0% — libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
CVE-2026-49977 [MEDIUM 4.3] depth=sunlit score=24 — tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies
CVE-2026-49858 [MEDIUM 5.9] depth=sunlit score=32 epss=0% — API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
CVE-2026-5078 [MEDIUM 5.3] depth=sunlit score=29 epss=0% — morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
MAL-2026-10119 [NONE] depth=sunlit score=3 — Malicious code in sankislayer (PyPI)
MAL-2026-10100 [NONE] depth=sunlit score=3 — Malicious code in proxy-check-i (PyPI)
CVE-2026-48596 [LOW] depth=sunlit score=14 epss=0% — Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`
CVE-2026-48594 [HIGH] depth=twilight score=41 epss=0% — Tesla has decompression bomb on response body
CVE-2026-48595 [HIGH] depth=twilight score=41 epss=0% — Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering
CVE-2026-48597 [HIGH] depth=twilight score=41 epss=0% — Tesla vulnerable to atom exhaustion via untrusted URL scheme
CVE-2026-48598 [LOW] depth=sunlit score=14 epss=0% — Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values
CVE-2026-48861 [LOW] depth=sunlit score=14 epss=0% — mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`
CVE-2026-49753 [MEDIUM] depth=sunlit score=28 epss=0% — mint: Content-Length header accepts non-RFC "+" sign prefix
CVE-2026-49754 [HIGH] depth=twilight score=41 epss=0% — mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)
CVE-2026-48862 [HIGH] depth=twilight score=41 epss=0% — mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS
CVE-2026-55252 [MEDIUM] depth=sunlit score=28 — OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect
CVE-2026-53956 [MEDIUM 5.4] depth=sunlit score=30 — Rattler vulnerable to package cache path traversal via conda package build string
CVE-2026-49834 [MEDIUM 5.9] depth=sunlit score=32 — sigstore-go has a multi-log threshold bypass via single compromised log
CVE-2026-49836 [MEDIUM] depth=sunlit score=28 — psd-tools vulnerable to arbitrary file write via smart-object filename
CVE-2026-49837 [MEDIUM 5.9] depth=sunlit score=32 — GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries
CVE-2026-49838 [MEDIUM 5.9] depth=sunlit score=32 — GoBGP confederation validation panics on empty AS_PATH attribute
CVE-2026-49851 [HIGH 7.5] depth=twilight score=41 epss=0% —  Mistune: Potential DoS via quadratic-time parsing in parse_link_text
# next: MTc4MzY0MTIwNzE5NHxDVkUtMjAyNi00OTg1MQ