Security advisories

high2026-06-18

CVE-2026-55225-Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

strimzi/strimzi-kafka-operator · GHSA-mw9r-p8xp-wx96

medium2026-06-18

CVE-2026-53863-OpenClaw: Tool group policy callers could accept unvalidated group IDs

openclaw/openclaw · GHSA-985f-72mj-8gf7

high2026-06-18

CVE-2026-53842-OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

openclaw/openclaw · GHSA-fq9j-vw4w-fr6v

high2026-06-18

CVE-2026-53866-OpenClaw: Shell inline-command parsing could miss an allowlist check

openclaw/openclaw · GHSA-f397-5vjw-v2c2

high2026-06-18

CVE-2026-53843-OpenClaw: Pairing-scoped device session could restore revoked node token authority

openclaw/openclaw · GHSA-q99w-vh6v-q3v7

high2026-06-18

CVE-2026-53864-OpenClaw: Host environment sanitizer missed two Node.js control variables

openclaw/openclaw · GHSA-ccwh-wwpp-6wg5

low2026-06-18

CVE-2026-55671- ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components

zitadel/zitadel · GHSA-29jh-8cfq-rr8x

medium2026-06-18

CVE-2026-55745-Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module

cotonti/cotonti · GHSA-hp3v-wp32-953h

high2026-06-18

CVE-2026-55746-Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module

cotonti/cotonti · GHSA-86hp-hf3j-3m8r

high2026-06-18

CVE-2026-55744-Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module

cotonti/cotonti · GHSA-wx35-cv59-9gwr

critical2026-06-18

CVE-2026-55742-Cotonti: Cross-Site Request Forgery in the administration rights handler

cotonti/cotonti · GHSA-7g3p-35vc-mgjr

medium2026-06-18

CVE-2026-54386-marimo contains a reflected cross-site scripting vulnerability in the notebook page

marimo-team/marimo · GHSA-8m59-7xv8-735h

medium2026-06-17

CVE-2026-53870-Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)

nousresearch/hermes-agent · GHSA-99f9-j8r3-p853

high2026-06-17

CVE-2026-11407-Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

pimcore/pimcore · GHSA-7p36-fq2r-4h7r

high2026-06-17

CVE-2026-53869-Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation

nousresearch/hermes-agent · GHSA-4pqm-j46f-795x

medium2026-06-17

CVE-2026-55590-CakePHP Authentication: Open redirect weakness via backslash bypass

cakephp/authentication · GHSA-hhpq-7wg4-36jm

critical2026-06-17

CVE-2026-55518-Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

avo-hq/avo · GHSA-8fq9-273g-6mrg

medium2026-06-17

CVE-2026-55517-Deno: Denial of service via non-ASCII bytes in WebSocket response headers

denoland/deno · GHSA-x2qc-cmh9-f4hf

critical2026-06-17

CVE-2026-55471-HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

hapifhir/org.hl7.fhir.core · GHSA-2f55-g35j-5jmf

high2026-06-17

CVE-2026-55470-HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

hapifhir/org.hl7.fhir.core · GHSA-fxj4-p9xp-37v5