Security advisories

high2026-07-01

CVE-2026-49986-Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`

cdeust/cortex · GHSA-gvpp-v77h-5w8g

low2026-07-01

Schema.org has cross-site scripting (XSS) via script break-out in toScript() output

spatie/schema-org · GHSA-hwmc-r6mf-jh83

high2026-07-01

CVE-2026-54428-Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

apache/httpcomponents-core · GHSA-v3jc-474w-2wm6

high2026-07-01

CVE-2026-54399-Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service

apache/httpcomponents-core · GHSA-hf6x-8p5f-cgmf

medium2026-07-01

CVE-2026-12480-Keras: HDF5 virtual datasets can disclose local files

keras-team/keras · GHSA-26c4-7vv6-867j

high2026-07-01

CVE-2026-49864-wetty vulnerable to DOM XSS via file-download filename

butlerx/wetty · GHSA-p26j-h7wj-r568

medium2026-07-01

EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components

easycorp/easyadminbundle · GHSA-2wwr-9x6f-88gp

high2026-07-01

CVE-2026-49857-auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

ymw0407/auth-fetch-mcp · GHSA-pvrj-8cg3-j5f8

medium2026-07-01

CVE-2026-49856-@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization

vmoranv/jshookmcp · GHSA-c5r6-m4mr-8q5j

high2026-07-01

CVE-2026-46487-GeoNetwork has ACL bypass on Elasticsearch search when request body omits query field

geonetwork/core-geonetwork · GHSA-582q-v28r-7cxr

high2026-07-01

CVE-2026-39379-GeoNetwork has reflected XSS through client-side template injection

geonetwork/core-geonetwork · GHSA-2v4m-fw6c-g78f

high2026-07-01

CVE-2022-46295-Open Babel has out-of-bounds write in MSI translationVectors[]

openbabel/openbabel · GHSA-f8h2-c479-vqxf

high2026-07-01

CVE-2022-46294-Open Babel has out-of-bounds write in MOPAC IN translationVectors[] (Tv atom)

openbabel/openbabel · GHSA-mjmg-352j-f456

high2026-07-01

CVE-2022-46293-Open Babel has out-of-bounds write in MOPAC translationVectors[] (FINAL POINT)

openbabel/openbabel · GHSA-7h6r-6p76-68c9

high2026-07-01

CVE-2022-46291-Open Babel has out-of-bounds write in Gaussian translationVectors[]

openbabel/openbabel · GHSA-jg3h-pv7c-4f9c

high2026-07-01

CVE-2022-46290-Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant)

openbabel/openbabel · GHSA-5rff-8f7c-8jmw

high2026-07-01

CVE-2022-46289-Open Babel has out-of-bounds write in ORCA nAtoms parser

openbabel/openbabel · GHSA-rj4c-r689-cm87

high2026-07-01

CVE-2022-46280-Open Babel has uninitialized pointer dereference in PQS pFormat

openbabel/openbabel · GHSA-8qxc-57hf-hc9j

high2026-07-01

CVE-2022-44451-Open Babel has uninitialized pointer dereference in MSI atom parser

openbabel/openbabel · GHSA-jr2x-6qf6-q5mc

high2026-07-01

CVE-2022-43607-Open Babel has out-of-bounds write in MOL2 attribute/value parser

openbabel/openbabel · GHSA-vjg6-gm8m-v5g6