Skip to content

Get in Touch Free Tools

Loading

We help organizations discover and eliminate security vulnerabilities before attackers do, through offensive testing, engineering, and strategic advisory.

[email protected]Serving clients across Europe, Middle East and Africa

Services

Pentesting
Web & API Security
Secure Code Review
Network Security
Cloud Security
Consulting
Security Engineering
Microsoft 365
Web & App Dev
AI Services
Cloudflare Security
AWS Security

Company

Resources
Insights
News
Advisories
Supply Chain Advisories
Data Breach Directory
Free Tools
Phishing IQ Quiz
Free Knowledge
About
Why Us
FAQ
Contact

Regional

EMEA Compliance Map
UK Security Services
EU Security (NIS2 & DORA)
Middle East Security
South Africa Security
DACH Security (DE/AT/CH)
Financial Services Security
Shopify Security
WordPress Security

Offensive security

Beirut Dubai Riyadh Doha

Get started

Book a Free Consultation Request an assessment Let's Collab

Follow us

© 2026 KazaSec. All rights reserved.

Privacy Policy Terms of Service

We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.

Supply chain advisories

Open-source package vulnerabilities, tracked automatically.

GitHub-reviewed security advisories across the open-source ecosystem, tracked automatically, searchable and filterable, and every entry we've published stays live.

This is GitHub's own Security Advisories database, human-reviewed disclosures for vulnerable open-source packages across npm, PyPI, Go, Maven, RubyGems, and more. Unlike our CISA KEV advisories, these aren't all confirmed under active exploitation, they're disclosed vulnerabilities in the dependencies real applications run on. See our piece on third-party and supply chain risk for why this matters even when nothing here is on the news.

Severity

CriticalHighMediumLow

CVE-2026-119186Medium 5.9

Forge: AES-GCM authentication bypass via unvalidated tagLength option

npm , node-forge

Published 2026-10-30

CVE-2026-118782High 7.5

Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

npm , node-forge

Published 2026-10-30

CVE-2026-119188High 7.5

Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

npm , node-forge

Published 2026-10-30

CVE-2026-119187High 7.5

Forge: Denial of service in TLS record processing via call stack exhaustion

npm , node-forge

Published 2026-10-30

CVE-2026-119190High 7.4

Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

npm , node-forge

Published 2026-10-30

CVE-2026-119193Medium

PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

composer , phpunit/phpunit

Published 2026-10-30

CVE-2026-96631High 8.2

AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

composer , adminneo-org/adminneo

Published 2026-10-30

CVE-2026-96632High

AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

composer , adminneo-org/adminneo

Published 2026-10-30

CVE-2026-96630High 7.2

AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)

composer , adminneo-org/adminneo

Published 2026-10-30

CVE-2026-96629Medium 6.8

AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery

composer , adminneo-org/adminneo

Published 2026-10-30

CVE-2026-54442Medium 4.8

NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

maven , gov.nsa.emissary:emissary

Published 2026-10-30

GHSA-5xjx-3w67-w9x9Critical

pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

actions , pypa/gh-action-pypi-publish

Published 2026-10-30

NewerPage 3 of 94Older