Security advisories

critical2026-07-30

CVE-2026-67429-Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

flytohub/flyto-core · GHSA-2956-977x-2w3r

medium2026-07-30

CVE-2026-67435-linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

linuxfabrik/monitoring-plugins · GHSA-4jc5-g844-4x33

high2026-07-30

CVE-2026-67431-MCP Ruby SDK: Ruby SSE Session Poisoning

modelcontextprotocol/ruby-sdk · GHSA-5p9g-j988-pcwv

high2026-07-30

CVE-2026-67432-MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

modelcontextprotocol/ruby-sdk · GHSA-h669-8m4g-r2hc

medium2026-07-30

CVE-2026-67430-MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

modelcontextprotocol/ruby-sdk · GHSA-52jp-gj8w-j6xh

medium2026-07-30

CVE-2026-63119-MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

modelcontextprotocol/ruby-sdk · GHSA-7683-3w9x-ch42

medium2026-07-30

CVE-2026-63118-MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

modelcontextprotocol/ruby-sdk · GHSA-rjr6-rcgv-9m7m

medium2026-07-30

CVE-2026-67438-OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

olivetin/olivetin · GHSA-xc5w-4v5w-7x65

medium2026-07-30

CVE-2026-67439-OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

olivetin/olivetin · GHSA-jm28-2wcr-qf3h

high2026-07-30

CVE-2026-67437-OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

olivetin/olivetin · GHSA-xpxj-f2fm-rqch

medium2026-07-29

CVE-2026-13346-pip would incorrectly handle doubly-encoded package URLs from indexes

pypa/pip · GHSA-qwm4-qh6w-59xr

medium2026-07-29

CVE-2026-54705-mathlive's Lack of Escaping of HTML allows for XSS

arnog/mathlive · GHSA-fm7p-gw32-828p

medium2026-07-29

CVE-2026-54704-OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

open-telemetry/opentelemetry-java-instrumentation · GHSA-rwqx-fvqh-6wm4

medium2026-07-29

CVE-2026-54712-OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

open-telemetry/opentelemetry-java-instrumentation · GHSA-fq3f-m5qm-99f5

low2026-07-29

ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal

basecamp/activerecord-tenanted · GHSA-pmwx-rm49-xv39

high2026-07-29

netfoil: Incorrect block responses could lead to localhost traffic

tinfoil-factory/netfoil · GHSA-xvg2-cgv6-6h7v

critical2026-07-29

CVE-2026-54680-Logging operator has Fluentd configuration injection that allows remote code execution

kube-logging/logging-operator · GHSA-mjqf-28ph-426h

high2026-07-29

CVE-2026-54693-ZITADEL Users Can Self-Verify Email/Phone via API

zitadel/zitadel · GHSA-jq8w-8q2f-ffm9

high2026-07-29

CVE-2026-54727-proot-distro has a Container Isolation Bypass via Crafted Restore Archive

termux/proot-distro · GHSA-7h3g-4w2f-fj2f

high2026-07-29

CVE-2026-54574-`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

termux/proot-distro · GHSA-9xq3-3fqg-4vg7