tag
Exfiltration
High
Immich Stored XSS to API Key Exfiltration and Account Hijacking (CVE-2026-35455)
CVE-2026-35455·
Immich (self-hosted photo/video management)
unpatched
Medium
Claude Code WebFetch Hardcoded HuggingFace Bare-Hostname Allow-List Bypass — CVE-2026-54316
CVE-2026-54316 (GHSA-fg94-h982-f3mm)·
@anthropic-ai/claude-code (npm package, Claude Code CLI)
patched