Security advisories

critical2026-06-10

CVE-2026-53474-Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands

kubev2v/migration-planner · GHSA-vf2h-7x3w-97fr

critical2026-06-10

CVE-2026-53470-Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs

kubev2v/migration-planner · GHSA-v5m8-5455-qw2x

critical2026-06-10

CVE-2026-53475-Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication

kubev2v/assisted-migration-agent · GHSA-8g5p-jxp9-457c

critical2026-06-10

CVE-2026-53476-Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution

kubev2v/assisted-migration-agent · GHSA-7j4w-x8x8-5mvg

critical2026-06-10

CVE-2026-53469-Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API

kubev2v/migration-planner · GHSA-6xvf-9742-48w2

critical2026-06-10

CVE-2026-53471-Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation

kubev2v/migration-planner · GHSA-2fqw-7c6r-2cq6

medium2026-06-10

CVE-2026-53438-Jenkins: Missing permission check allows unauthorized cancellation of queue items

jenkinsci/jenkins · GHSA-mw82-xcg6-gx79

medium2026-06-10

CVE-2026-53442-Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations

jenkinsci/jenkins · GHSA-m6wv-wh8g-64xc

high2026-06-10

CVE-2026-53435-Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation

jenkinsci/jenkins · GHSA-g2xq-2v27-4rh3

medium2026-06-10

CVE-2026-53439-Jenkins exposes other users' timezone and view names to users with Overall/Read permission

jenkinsci/jenkins · GHSA-g28p-6mcc-v4rv

high2026-06-10

CVE-2026-53441-Jenkins: Stored XSS vulnerability in node offline cause description

jenkinsci/jenkins · GHSA-93qh-vwrm-c5pw

medium2026-06-10

CVE-2026-53440-Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"

jenkinsci/jenkins · GHSA-92m7-4fpw-2wxm

medium2026-06-10

CVE-2026-53437-Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL

jenkinsci/jenkins · GHSA-463r-5m89-4xfr

medium2026-06-10

CVE-2026-53436-Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL

jenkinsci/jenkins · GHSA-3rqh-hch3-jhpc

high2026-06-10

CVE-2025-71330-image-size: ICNS parser allows denial of service through an infinite loop

image-size/image-size · GHSA-w3rx-r6r6-pgpr

high2026-06-10

CVE-2025-71329-image-size: JXL and HEIF parsers allow denial of service through infinite loops

image-size/image-size · GHSA-5p2g-fcmc-qvqq

medium2026-06-10

CVE-2026-49397-Nezha's private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data

nezhahq/nezha · GHSA-vrmh-5mmx-hjwx

high2026-06-10

CVE-2026-49396-Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents

nezhahq/nezha · GHSA-8qhj-4f8c-j8qg

critical2026-06-10

CVE-2026-48031-Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

dhax/go-base · GHSA-mqq6-462x-jxmm

low2026-06-10

CVE-2026-48051-Papra HTTP redirect bypass can lead to SSRF via webhook delivery system

papra-hq/papra · GHSA-5g86-85rp-f9hx