Security advisories

medium2026-07-27

CVE-2023-37465-org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages

xwiki-contrib/application-discussions · GHSA-4j38-rw27-97gx

medium2026-07-27

CVE-2026-66053-Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit

apache/thrift · GHSA-hwrj-9rr4-24xh

high2026-07-27

CVE-2026-43871-Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

apache/thrift · GHSA-8wv5-x4w7-5gww

high2026-07-27

CVE-2026-41608-Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability

apache/thrift · GHSA-6pjx-3pjc-mrj8

high2026-07-25

CVE-2025-71408-NLTK vulnerable to Eval Injection via collocations CLI arguments

nltk/nltk · GHSA-848c-c2cx-j7qx

high2026-07-24

CVE-2026-73500-etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

etcd-io/etcd · GHSA-6vch-q96h-7gc3

medium2026-07-24

FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller

agentfront/frontmcp · GHSA-8q49-2h5h-434x

medium2026-07-24

CVE-2026-73502-kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

getkin/kin-openapi · GHSA-jpcw-4wr7-c3vq

high2026-07-24

CVE-2026-16796-AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

aws/bedrock-agentcore-sdk-python · GHSA-j6g5-3hh3-pgw8

high2026-07-24

CVE-2026-73499-etcd: Watch API authorization bypass via open-ended range requests

etcd-io/etcd · GHSA-xg4h-6gfc-h4m8

high2026-07-24

CVE-2026-16756-Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

smithy-lang/smithy-rs · GHSA-jvxp-qmx7-gjpx

high2026-07-24

CVE-2026-73568-libp2p: yamux connection DoS via oversized data frame

libp2p/py-libp2p · GHSA-hmj8-5xmh-5573

medium2026-07-24

CVE-2026-73647-Quasar: Prototype pollution in the extend() utility

quasarframework/quasar · GHSA-3r53-75j5-3g7j

high2026-07-24

CVE-2026-73505-Oh My Posh: Arbitrary command execution via template injection in the path segment

jandedobbeleer/oh-my-posh · GHSA-6xj8-qv9j-xcjq

medium2026-07-24

CVE-2026-73506-Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

jandedobbeleer/oh-my-posh · GHSA-fwjx-9p69-h25h

high2026-07-24

CVE-2026-102695-OmniFaces: Forged combined-resource IDs and related output/push boundaries

omnifaces/omnifaces · GHSA-fp43-vj7g-pg92

high2026-07-24

CVE-2026-73413-Shescape: Quadratic-time denial of service in the flag-protection

ericcornelissen/shescape · GHSA-gm3r-q2wp-hw87

medium2026-07-24

CVE-2026-73411-Shescape: Home-directory disclosure in assignment context on Unix with Dash

ericcornelissen/shescape · GHSA-q53c-4prm-w95q

critical2026-07-24

CVE-2026-73414-Shescape: Shell injection via unescaped parentheses on Windows with CMD

ericcornelissen/shescape · GHSA-w4hw-qcx7-56pr

medium2026-07-24

CVE-2026-73412-Shescape: Path disclosure on Unix with Zsh

ericcornelissen/shescape · GHSA-6v4m-fw66-8r4x