Security advisories

medium2026-07-16

CVE-2026-53718-Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

envoyproxy/gateway · GHSA-fcrp-7gc2-93g7

medium2026-07-16

CVE-2026-50166-kumactl connects to control plane without verifying TLS certificate when no CA is configured

kumahq/kuma · GHSA-v95x-xhq5-4929

critical2026-07-16

CVE-2026-15925-Snowflake Connector for Python improperly verifies TLS hostnames

snowflakedb/snowflake-connector-python · GHSA-5cc2-282f-jjq2

critical2026-07-16

CVE-2025-65720-GPT Researcher MCP STDIO configuration allows remote command execution

assafelovic/gpt-researcher · GHSA-8j86-h8gg-797p

low2026-07-15

CVE-2026-58196-ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

stacklok/toolhive · GHSA-pr64-jmmf-jp54

medium2026-07-15

adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files

adawolfa/isdoc · GHSA-xg43-5579-qw6v

high2026-07-15

CVE-2026-54504-@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

andrea9293/mcp-documentation-server · GHSA-6f5r-5672-72j7

high2026-07-15

CVE-2026-50289-systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

sebhildebrandt/systeminformation · GHSA-5xpp-75jx-m839

high2026-07-15

CVE-2026-50285-Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

pomerium/pomerium · GHSA-ggw3-5987-rx77

high2026-07-15

CVE-2026-50276-dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

datadog/dd-trace-rb · GHSA-p5f6-rccc-jv98

high2026-07-15

CVE-2026-50274-dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS

datadog/dd-trace-go · GHSA-74j5-xf3v-crq8

high2026-07-15

CVE-2026-50273-dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS

datadog/dd-trace-dotnet · GHSA-38wr-vpc7-2mp4

high2026-07-15

CVE-2026-50272-dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

datadog/dd-trace-js · GHSA-wxqq-gcq8-c443

high2026-07-15

CVE-2026-50271-dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

datadog/dd-trace-py · GHSA-mw54-j2v2-42hr

high2026-07-15

CVE-2026-50270-dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

datadog/dd-trace-java · GHSA-74xj-wh4w-vqxc

medium2026-07-15

CVE-2026-54497-ViewComponent: Reused Component Instances Retain Stale Render Context

viewcomponent/view_component · GHSA-9h85-g7w3-rh49

high2026-07-15

CVE-2026-54498-ViewComponent: around_render HTML-Safety Bypass

viewcomponent/view_component · GHSA-97jw-64cj-jc58

medium2026-07-15

CVE-2026-54495-open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

open-feature/open-feature-operator · GHSA-398h-7f66-3h4p

high2026-07-15

django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization

django-haystack/django-haystack · GHSA-r3hx-x5rh-p9vv

medium2026-07-15

serde_with: KeyValueMap serialization panics on empty sequence or map entries

jonasbb/serde_with · GHSA-7gcf-g7xr-8hxj