Security advisories

high2026-06-11

CVE-2026-40987-Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem

spring-projects/spring-integration · GHSA-792x-6vq6-j8r9

medium2026-06-11

CVE-2026-40985-Spring Web Flow has Data Binding Vulnerability with Unified EL Parser

spring-projects/spring-webflow · GHSA-9ggw-87m9-9gfc

high2026-06-11

CVE-2026-10142-kafka-python vulnerable to denial of service through an unvalidated protocol frame length

dpkp/kafka-python · GHSA-m3px-q5gj-j9x7

high2026-06-11

CVE-2026-10143-kafka-python vulnerable to denial of service through an unbounded SCRAM iteration count

dpkp/kafka-python · GHSA-2jcm-hq8r-84wx

medium2026-06-10

CVE-2026-47768-nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

juev/nebula-mesh · GHSA-9pg3-25fq-p6cc

high2026-06-10

CVE-2026-47764-PDM wheel installation leads to Path Traversal via overridden write_to_fs

pdm-project/pdm · GHSA-78v8-vpjp-cjqh

medium2026-06-10

CVE-2026-47763-PDM: Project-Local State and Config Writes Follow Symlinks

pdm-project/pdm · GHSA-ghq2-5c67-fprm

medium2026-06-10

CVE-2026-47753-Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)

lxc/incus · GHSA-8g7m-96c8-8wwc

medium2026-06-10

CVE-2026-47751-Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration

anthropics/claude-code-action · GHSA-8q5r-mmjf-575q

critical2026-06-10

CVE-2026-48063-Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload

whiskeysockets/baileys · GHSA-qvv5-jq5g-4cgg

medium2026-06-10

CVE-2026-48061-Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

litestar-org/litestar · GHSA-3qmc-cj7q-62hv

high2026-06-10

CVE-2026-48060-Litestar has HTML Injection Through its CSRF Token

litestar-org/litestar · GHSA-542p-wvx7-72m4

medium2026-06-10

CVE-2026-48058-nebula-mesh: Session and OIDC state cookies lack the Secure attribute

juev/nebula-mesh · GHSA-rqfj-vv8r-xhqc

medium2026-06-10

CVE-2026-48025-nebula-mesh: Decrypted CA private key persists in heap after signing

juev/nebula-mesh · GHSA-8h84-fhqq-q58v

medium2026-06-10

CVE-2026-53698-Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set

silverpeas/silverpeas-core · GHSA-qv8h-rqr3-mph9

high2026-06-10

CVE-2026-25700-Apache Answer: AdminToken not invalidated after admin deactivation

apache/answer · GHSA-4gw2-vg4x-7p29

high2026-06-10

CVE-2026-47701-OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

open-telemetry/opentelemetry-operator · GHSA-cxh2-4639-vmc5

high2026-06-10

CVE-2026-47253-Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion

julien040/anyquery · GHSA-j9rx-rppg-6hh4

medium2026-06-10

CVE-2026-47155-vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

vllm-project/vllm · GHSA-3ww4-5jv9-j5gm

high2026-06-10

CVE-2025-53114-Acknowledgement extension out of memory

cometd/cometd · GHSA-cqgj-h8vf-4w59