Ghsa
3 articles
BreakingLitellm
A LiteLLM Enterprise proxy will leak its master key to a request with no API key. Upgrade to 1.106.5 (GHSA-w4c7-34wj-hqm8)
How to fix GHSA-w4c7-34wj-hqm8: upgrade litellm to 1.106.5, 1.105.6, 1.104.8 or 1.103.10, restart, then rotate LITELLM_MASTER_KEY. An unauthenticated request could make an Enterprise-licensed LiteLLM proxy read its own process environment and send it to an attacker host. CVSS 10.0.
HOL GuardBreakingCVE
Next.js image optimizer SSRF and cache poisons in September 2026 release
How to fix CVE-2026-94483: upgrade next to 15.5.27 or 16.3.8
HOL GuardBreakingGhsa
CVE-2026-94545 Next.js next/og ImageResponse RCE (GHSA-vcvr-r3jv-pc5j)
How to fix CVE-2026-94545: upgrade next to 16.3.6 (15.5.26 hardening if you stay on 15.x)
HOL GuardRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.