Security advisories

medium2026-06-03

CVE-2026-44545-daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames

django/daphne · GHSA-rrc9-mx66-ffcm

low2026-06-03

CVE-2026-10722-ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReader

cilium/ebpf · GHSA-xhgw-qwwf-pg32

critical2026-06-03

CVE-2026-47065-Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass

apache/mina · GHSA-v3pr-hxpr-mfm8

critical2026-06-03

CVE-2026-4035-MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration

mlflow/mlflow · GHSA-g35p-px32-whv6

low2026-06-03

CVE-2026-10691-DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption

wonderwhy-er/desktopcommandermcp · GHSA-r87g-78mx-3wg4

low2026-06-03

CVE-2026-10692-Code Index MCP is vulnerable to Uncontrolled Resource Consumption

johnhuang316/code-index-mcp · GHSA-647r-72hf-4vmh

low2026-06-03

CVE-2026-10690-DesktopCommanderMCP is vulnerable to SSRF

wonderwhy-er/desktopcommandermcp · GHSA-5xx3-j724-wmx5

medium2026-06-02

CVE-2026-46718-Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes

apache/calcite · GHSA-c2rv-hwqm-wjpg

high2026-06-02

CVE-2026-3514-Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'

prefecthq/prefect · GHSA-c635-393c-hcx2

medium2026-06-02

CVE-2026-3198-MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions

mlflow/mlflow · GHSA-r5m9-wm49-959f

low2026-06-02

CVE-2026-10566- FoundationAgents MetaGPT: Deserialization through flawed argument mapping via Message.check_instruct_content()

foundationagents/metagpt · GHSA-3c3g-7hwg-9qmr

low2026-06-02

CVE-2026-10300-SGLang: Reachable Assertion via  lora_path  in LoRAManager enables remote Denial of Dervice

sgl-project/sglang · GHSA-m2jr-x4gq-5rmj

medium2026-06-02

CVE-2026-10291-Claw Orchestrator has inefficient regular expression complexity via validateRegex()

enderfga/claw-orchestrator · GHSA-95f6-rfpg-c3w8

medium2026-06-01

CVE-2026-49138-Nanobot contains a server-side request forgery vulnerability in the web_fetch tool

hkuds/nanobot · GHSA-434r-7c99-hwf3

medium2026-06-01

CVE-2026-40989-Spring Cloud Function Context has Uncontrolled Recursion

spring-cloud/spring-cloud-function · GHSA-x9c7-5h6g-hq8q

medium2026-06-01

CVE-2026-10281-Claw Orchestrator is missing authentication for the component API Endpoint

enderfga/claw-orchestrator · GHSA-q6qc-xp4q-rjq5

medium2026-06-01

CVE-2026-8643- pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

pypa/pip · GHSA-wf93-45jw-7689

low2026-06-01

CVE-2026-10532-Logback vulnerable to Object Injection through HardenedObjectInputStream modules

qos-ch/logback · GHSA-jhq6-gfmj-v8fx

low2026-06-01

CVE-2026-47191-kas checks out SHA-like git branches as valid commits

siemens/kas · GHSA-qjwp-hrq6-r26r

high2026-06-01

CVE-2026-47412-praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

mervinpraison/praisonai · GHSA-g8rr-7rj2-f627