Security advisories

critical2026-07-07

CVE-2026-27823-EGroupware has a Remote Code Execution Vulnerability

egroupware/egroupware · GHSA-h9qx-v5xp-ph8p

medium2026-07-07

CVE-2026-49296-apache-airflow DAG source authorization bypass exposes co-located DAG source

apache/airflow · GHSA-4fh7-7jx4-8f6c

medium2026-07-07

CVE-2026-49487-Apache Airflow exposes deferred trigger kwargs in task-instance API responses

apache/airflow · GHSA-22hf-vx2v-gjff

medium2026-07-07

CVE-2026-48892-Apache Airflow exposes secrets backend credentials through the Config API

apache/airflow · GHSA-9933-5rrp-mfwx

medium2026-07-07

CVE-2026-48828-Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API

apache/airflow · GHSA-563f-2439-rmq4

medium2026-07-07

CVE-2026-48891-Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph

apache/airflow · GHSA-3322-mjxh-9mp5

critical2026-07-07

CVE-2026-33264-Apache Airflow allows code execution through unsafe serialized DAG deserialization

apache/airflow · GHSA-2943-9672-r45w

medium2026-07-07

CVE-2026-59710-showdown allows stored cross-site scripting through table header ID injection

showdownjs/showdown · GHSA-22g5-r2x5-97cx

low2026-07-06

CVE-2026-35381-cut: -s ignored in -z -d '' newline-delimiter mode

uutils/coreutils · GHSA-pmfc-4wjj-gmhx

low2026-07-06

CVE-2026-35361-mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)

uutils/coreutils · GHSA-r9hw-mj3w-phcq

high2026-07-06

CVE-2026-35341-mkfifo: permissions of an existing file are changed after FIFO creation fails

uutils/coreutils · GHSA-pmf6-rcx4-v53v

high2026-07-06

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write

coder/coder · GHSA-qrwj-vh9x-gw5v

high2026-07-06

OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export

openremote/openremote · GHSA-cgfv-jrfp-2r7v

low2026-07-06

CVE-2026-55630-Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

kiwitcms/kiwi · GHSA-473p-56xx-vg67

high2026-07-06

CVE-2026-55501-9router: Login brute-force protection bypass via spoofed X-Forwarded-For header

decolua/9router · GHSA-7cfm-pqrj-xgq7

critical2026-07-06

CVE-2026-55500-9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover

decolua/9router · GHSA-qvfm-67h2-2qfx

high2026-07-06

CVE-2026-55794-Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

craftcms/cms · GHSA-f74w-488g-8x5r

medium2026-07-06

CVE-2026-55793-Craft CMS: Stored XSS via Structure entry title in table view

craftcms/cms · GHSA-xrqc-p465-2xvg

medium2026-07-06

CVE-2026-59711-showdown metadata title handling allows cross-site scripting

showdownjs/showdown · GHSA-cr32-g25g-vxjj

medium2026-07-06

CVE-2026-55792-Craft CMS: Sensitive File Disclosure / Server-Side File Read

craftcms/cms · GHSA-287w-mxq6-x2cp