Security advisories

critical2026-06-17

CVE-2026-55450-Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

langflow-ai/langflow · GHSA-x223-p2gf-v735

high2026-06-17

CVE-2026-55760-handlebars.java FileTemplateLoader Path Traversal

jknack/handlebars.java · GHSA-r4gv-qr8j-p3pg

high2026-06-17

CVE-2026-55409-Filament: Disabled RichEditor field state can be used for XSS

filamentphp/filament · GHSA-m9cv-24rx-8mv7

high2026-06-17

CVE-2026-55405-LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector

langchain4j/langchain4j · GHSA-2mfg-cc43-9pcj

medium2026-06-17

CVE-2026-48591-earmark: Stored XSS via unescaped HTML attribute values

pragdave/earmark · GHSA-52mm-h59v-f3c7

medium2026-06-17

CVE-2026-12515-katello: missing repository authorization in content_uploads exposes cross-product content existence

katello/katello · GHSA-c43c-rf7g-5xpg

high2026-06-17

CVE-2025-26240-pdfkit: Path traversal in from_string

jazzcore/python-pdfkit · GHSA-9g3x-6x24-vf9f

medium2026-06-17

CVE-2026-55748-OpenStack Horizon RC file generation does not escape special characters in project names

openstack/horizon · GHSA-6wrm-x65g-hr4p

high2026-06-17

CVE-2026-49268-Apache Shiro: LDAP DN Injection in DefaultLdapRealm

apache/shiro · GHSA-x96m-rh44-vgv8

critical2026-06-17

CVE-2026-50203-Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory

apache/airflow · GHSA-qf38-jq28-3ccq

medium2026-06-17

CVE-2026-47340-Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.

apache/dolphinscheduler · GHSA-694g-j8pj-cjj5

medium2026-06-17

CVE-2026-42357-Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.

apache/dolphinscheduler · GHSA-wv7f-c794-82v6

medium2026-06-17

CVE-2026-41280-Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

apache/dolphinscheduler · GHSA-wh3w-v6gj-fqh2

critical2026-06-17

CVE-2026-32966-Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure

apache/dolphinscheduler · GHSA-r989-cjhx-3v49

critical2026-06-17

CVE-2026-32967-Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks

apache/dolphinscheduler · GHSA-85g9-8j9g-p486

medium2026-06-17

CVE-2026-55636-Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

projectcapsule/capsule · GHSA-gwxr-7h77-7777

medium2026-06-17

CVE-2026-9595-webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

webpack/webpack-dev-server · GHSA-mx8g-39q3-5c79

high2026-06-17

CVE-2026-5079-Multer vulnerable to Denial of Service via deeply nested field names

expressjs/multer · GHSA-72gw-mp4g-v24j

medium2026-06-17

CVE-2026-5038-Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

expressjs/multer · GHSA-3p4h-7m6x-2hcm

medium2026-06-17

CVE-2026-25779-Gitea: Open Redirect via redirect_to

go-gitea/gitea · GHSA-j5r2-4c8j-xc3m