Security advisories

medium2026-05-29

CVE-2026-47121-Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

sparkle-project/sparkle · GHSA-hg88-v3cw-3qrh

medium2026-05-29

go-git: Malformed Git object data may cause panics or resource exhaustion

go-git/go-git · GHSA-w5pp-99ch-qj29

medium2026-05-29

CVE-2026-46705-russh server userauth state is not reset when authentication principal changes

eugeny/russh · GHSA-hpv4-5h6f-wqr3

high2026-05-29

CVE-2026-46702-russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets

eugeny/russh · GHSA-wwx6-x28x-8259

critical2026-05-29

CVE-2026-8838-amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection

aws/amazon-redshift-python-driver · GHSA-29h4-r29x-hchv

medium2026-05-29

uv is vulnerable to arbitrary file write through entry point names

astral-sh/uv · GHSA-4gg8-gxpx-9rph

high2026-05-29

CVE-2026-47255-AgenticMail API/storage and outbound relay hardening fixes

agenticmail/agenticmail · GHSA-wjjv-3mj2-39hf

medium2026-05-29

CVE-2026-47248-Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers

parse-community/parse-server · GHSA-8cph-rgr4-g5vj

medium2026-05-29

tar has a PAX header desynchronization issue

composefs/tar-rs · GHSA-3pv8-6f4r-ffg2

medium2026-05-29

astral-tokio-tar has a PAX Header Desynchronization issue

astral-sh/tokio-tar · GHSA-3cv2-h65g-fgmm

high2026-05-29

CVE-2026-38739-ezsystems/ezpublish-legacy has a SQL injection in dfscleanup

ezsystems/ezpublish-legacy · GHSA-xg9x-h37w-h3r3

medium2026-05-29

CVE-2026-46690-unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race

spearman/unbounded-spsc · GHSA-6m57-8r3p-pqx6

medium2026-05-29

CAPM3 vulnerable to Cross-Namespace resource access

metal3-io/cluster-api-provider-metal3 · GHSA-rf84-wr5g-m3rp

high2026-05-29

CVE-2026-10108-xiaomusic contains an unauthenticated path traversal vulnerability

hanxi/xiaomusic · GHSA-5j8p-5rrj-8wjg

high2026-05-29

CVE-2026-10105-agno contains a SQL injection vulnerability

agno-agi/agno · GHSA-82m5-3pcp-hccq

medium2026-05-29

CVE-2026-47190-IPAM controller service account granted unnecessary full access to Secrets

metal3-io/ip-address-manager · GHSA-49pm-43hf-6xfq

medium2026-05-29

Ironic Standalone Operator's controller modifies user-owned resources without consent

metal3-io/ironic-standalone-operator · GHSA-hfc8-w5f4-3x6m

medium2026-05-29

Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces

metal3-io/ironic-standalone-operator · GHSA-7cwm-fpfh-rrch

medium2026-05-29

CVE-2026-47141-NodeVM observability builtins leak host process and HTTP request data

patriksimek/vm2 · GHSA-9g8x-92q2-p28f

high2026-05-29

CVE-2026-47139-NodeVM network builtin exclusions bypass via internal _http_client and _http_server

patriksimek/vm2 · GHSA-r9pm-gxmw-wv6p