Security advisories

critical2026-08-27

CVE-2026-47890-Spring Framework Server Sent Event stream corruption while rendering fragments

View chart →

spring-projects/spring-framework · GHSA-j9f9-w8pj-32f8

critical2026-08-27

CVE-2026-47892-Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

View chart →

spring-projects/spring-framework · GHSA-9qf2-26p9-2q2q

low2026-08-26

CVE-2026-44701-OpenSTAManager has HTML Injection in modules/utenti/edit.php

View chart →

devcode-it/openstamanager · GHSA-crx4-7mmq-j74j

high2026-08-26

LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates

View chart →

librenms/librenms · GHSA-7w8c-qgxg-m7jx

high2026-08-26

CVE-2026-54591-asyncssh has SCP Path Traversal to Arbitrary File Write

View chart →

ronf/asyncssh · GHSA-2wxc-x7rj-hg8f

medium2026-08-26

CVE-2026-54590-asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

View chart →

ronf/asyncssh · GHSA-qr67-gv47-xwwh

medium2026-08-26

CVE-2026-54614-cakephp/debug_kit: MailPreview contains unsafe reflection

View chart →

cakephp/debug_kit · GHSA-p46m-g734-vpc4

critical2026-08-26

CVE-2026-54569-senaite.core Vulnerable to Eval Injection and Missing Authorization

View chart →

senaite/senaite.core · GHSA-jrw6-7x4q-w25j

high2026-08-26

CVE-2026-54606-SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

View chart →

jihong88/suneditor · GHSA-w93q-cq9w-58p7

high2026-08-26

CVE-2026-54563-Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root

View chart →

cloudreve/cloudreve · GHSA-w5fv-7x5q-g8qp

medium2026-08-26

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

View chart →

openwisp/openwisp-ipam · GHSA-x287-5c68-36wp

critical2026-08-26

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

View chart →

aristoteleo/pantheonos · GHSA-93qj-5q5v-3c2h

medium2026-08-26

CVE-2026-55688-AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

View chart →

asynchttpclient/async-http-client · GHSA-m452-q8c9-rg2f

low2026-08-26

CVE-2026-54786-Wasmtime has a leak in WASIp1 `fd_renumber` implementation

View chart →

bytecodealliance/wasmtime · GHSA-3p27-qvp9-27qf

high2026-08-26

CVE-2026-54511-@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

View chart →

dahlia/logtape · GHSA-8h6h-x5pq-56fq

high2026-08-26

CVE-2026-54550-IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries

View chart →

izpack/izpack · GHSA-f63g-88cj-hjf9

critical2026-08-26

CVE-2026-54523-Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

View chart →

kyverno/kyverno · GHSA-79gf-7frw-68m9

low2026-08-26

CVE-2026-54548-kas Persistently Disables SSH Host Key Checking

View chart →

siemens/kas · GHSA-mv8m-v9v6-5f94

medium2026-08-26

CVE-2026-54553-Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

View chart →

jowilf/starlette-admin · GHSA-6753-gr46-6wpr

high2026-08-26

CVE-2026-54556-http4s has HTTP/2 Denial of Service with Ember Backend

View chart →

http4s/http4s · GHSA-vmm3-xgcx-67hm