Security advisories

critical2026-06-26

CVE-2026-48750-Incus has an arbitrary file write on host via `exec-output` symlink in crafted image

lxc/incus · GHSA-73hr-m85f-64v9

critical2026-06-26

CVE-2026-48749-Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image

lxc/incus · GHSA-2q3f-q5pq-g8wv

medium2026-06-26

CVE-2026-53463-ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments

imagemagick/imagemagick · GHSA-p9rq-q46c-g4x6

high2026-06-26

CVE-2026-46623-OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

openidentityplatform/openam · GHSA-gf57-4mp6-m85x

high2026-06-26

CVE-2026-46619-OpenAM Authentication Bypass via MSISDN LDAP Injection

openidentityplatform/openam · GHSA-xq73-fvmr-jvmm

medium2026-06-26

CVE-2026-44163-fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`

fluent-plugins-nursery/fluent-plugin-opentelemetry · GHSA-2jc5-xhx8-qj6h

low2026-06-26

CVE-2026-44162-fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3`

fluent/fluent-plugin-s3 · GHSA-xv9w-7v6q-hpjh

high2026-06-26

CVE-2026-44161-Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

fluent/fluentd · GHSA-72f5-rr8c-r6gr

high2026-06-26

CVE-2026-44160-Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

fluent/fluentd · GHSA-j9cw-hwqf-85w7

high2026-06-26

CVE-2026-44025-Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API

fluent/fluentd · GHSA-pr7j-96cj-549h

critical2026-06-26

CVE-2026-44024-Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

fluent/fluentd · GHSA-44hj-4m45-frj3

medium2026-06-26

CVE-2026-53462-ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails

imagemagick/imagemagick · GHSA-px7q-ggqj-hcf2

medium2026-06-26

CVE-2026-53914-JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution

jetbrains/kotlin · GHSA-r937-wjx7-w2jp

high2026-06-26

CVE-2026-49486-Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)

apache/airflow · GHSA-fgch-86x8-fv43

critical2026-06-25

CVE-2026-55166-Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

netflix/lemur · GHSA-v2wp-frmc-5q3v

medium2026-06-25

CVE-2026-55165- Lemur: JWT verifier honors attacker-supplied alg, enabling ATO

netflix/lemur · GHSA-r9gp-7f88-9r54

medium2026-06-25

CVE-2026-55164-Lemur user-update path stores plaintext passwords

netflix/lemur · GHSA-q437-g7fv-2jvv

medium2026-06-25

CVE-2026-55163-Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>

netflix/lemur · GHSA-x3vf-mgxj-7785

medium2026-06-25

CVE-2026-55162-Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF

netflix/lemur · GHSA-54vg-pfh7-jq95

high2026-06-25

CVE-2026-53461-ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop

imagemagick/imagemagick · GHSA-g22q-f7gc-5jhr