Security advisories

high2026-06-01

CVE-2026-47415-praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR

mervinpraison/praisonai · GHSA-xwq8-frcg-77q8

critical2026-06-01

CVE-2026-47413-praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members

mervinpraison/praisonai · GHSA-8g2p-pqm3-fcfh

medium2026-06-01

CVE-2026-47411-praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

mervinpraison/praisonai · GHSA-rcmc-q9rj-4wmq

high2026-06-01

CVE-2026-47417-praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

mervinpraison/praisonai · GHSA-cp4f-5m9r-5jc2

high2026-06-01

CVE-2026-47418-praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

mervinpraison/praisonai · GHSA-943m-6wx2-rc2j

medium2026-06-01

CVE-2026-47425-rattler has an entry-point path traversal in noarch:python install (arbitrary file write)

conda/rattler · GHSA-q53q-5r4j-5729

critical2026-06-01

CVE-2026-47428-Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

vitest-dev/vitest · GHSA-2h32-95rg-cppp

critical2026-06-01

CVE-2026-47429-When Vitest UI server is listening, arbitrary file can be read and executed

vitest-dev/vitest · GHSA-5xrq-8626-4rwp

high2026-06-01

CVE-2026-47423-DOMPurify XSS via selectedcontent re-clone

cure53/dompurify · GHSA-87xg-pxx2-7hvx

high2026-06-01

CVE-2026-48119-Nezha's authenticated agents can forge service-monitor results for other users' services

nezhahq/nezha · GHSA-4g6j-g789-rghm

high2026-06-01

CVE-2026-50287-@agenticmail/mcp Missing Authentication for Critical Function

agenticmail/agenticmail · GHSA-63gr-g7jc-v8rg

medium2026-06-01

CVE-2026-49328-Apache Fesod is vulnerable to Server-Side Request Forgery through its UrlImageConverter component

apache/fesod · GHSA-vqc2-c9jh-3jjv

medium2026-06-01

CVE-2026-48726-Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout

apache/airflow · GHSA-vr7m-c6v4-8cx8

medium2026-06-01

CVE-2026-46764-Apache Airflow has an Authorization Bypass Through User-Controlled Key

apache/airflow · GHSA-qphr-3mvq-v466

high2026-06-01

CVE-2026-48827-Apache MINA SSHD bundle sshd-git has a path traversal vulnerability

apache/mina-sshd · GHSA-mw4m-qhpg-j82m

medium2026-06-01

CVE-2026-49270-Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Exposure of Sensitive Information Through Metadata vulnerability

apache/activemq · GHSA-hf52-78x8-6w3w

medium2026-06-01

CVE-2026-46605-Apache ActiveMQ server has an incomplete authorization workflow

apache/activemq · GHSA-cpw7-g3p5-qrfq

high2026-06-01

CVE-2026-49157-Apache ActiveMQ has an Incorrect Default Permissions vulnerability

apache/activemq · GHSA-99qx-5qqr-4j95

medium2026-06-01

CVE-2026-49267-Apache Airflow has no certificate validation on SMTP STARTTLS connections

apache/airflow · GHSA-799x-qp47-8qwq

high2026-06-01

CVE-2026-49298-Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args

apache/airflow · GHSA-5j6p-jrrm-6x94