Security advisories

medium2026-05-28

CVE-2026-46405-OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

openbao/openbao · GHSA-7j6w-vvw2-5f9c

high2026-05-28

CVE-2026-9096-Casdoor doesn't enforce SAML assertion time bounds

casdoor/casdoor · GHSA-rgq2-93gj-ffxg

critical2026-05-28

CVE-2026-9098-Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest

casdoor/casdoor · GHSA-mfvp-7p3v-x9mh

medium2026-05-28

CVE-2026-9091-Casdoor allows users to bypass configured MFA requirements

casdoor/casdoor · GHSA-gv4m-v8c8-hr3g

critical2026-05-28

CVE-2026-9090-Casdoor has an authentication bypass

casdoor/casdoor · GHSA-fwgq-j9r9-qjgr

critical2026-05-28

CVE-2026-9094-Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check

casdoor/casdoor · GHSA-c9w5-qp6m-m395

medium2026-05-28

CVE-2026-41184-Calico Inserts Sensitive Information into Log File

projectcalico/calico · GHSA-9p7w-w5q6-mxj3

critical2026-05-28

CVE-2026-9093-Casdoor does not validate the AudienceRestriction element in SAML assertions

casdoor/casdoor · GHSA-3w4h-g9f5-j84p

high2026-05-28

CVE-2026-6720-Calico Inserts Sensitive Information into Log File

projectcalico/calico · GHSA-3m4q-ggcj-j6m4

critical2026-05-28

CVE-2026-9097-Casdoor doesn't verify that a JWT used for token exchange is still active

casdoor/casdoor · GHSA-339w-3hqm-9pjc

medium2026-05-28

CVE-2026-41185-Calico Inserts Sensitive Information into Log File

projectcalico/calico · GHSA-m67g-87rx-v42c

medium2026-05-28

CVE-2026-46380-compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

oscal-compass/compliance-trestle · GHSA-w76h-q7c6-jpjp

high2026-05-28

CVE-2026-44730-OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd

opencti-platform/opencti · GHSA-q537-qhj4-wcjx

medium2026-05-28

CVE-2026-46358-OpenBao's Inline Auth Incorrectly Redacted Headers

openbao/openbao · GHSA-q8cj-789h-vg24

high2026-05-28

CVE-2026-46345-compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

oscal-compass/compliance-trestle · GHSA-4q5v-7g7x-j79w

high2026-05-28

CVE-2026-45808-OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

openbao/openbao · GHSA-v8v8-cm84-m686

medium2026-05-28

CVE-2026-45774-compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

oscal-compass/compliance-trestle · GHSA-mj4x-vf5c-5xg8

low2026-05-28

CVE-2026-45756-Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS

symfony/symfony · GHSA-8v8v-g73j-492j

medium2026-05-28

CVE-2026-45755-Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

symfony/symfony · GHSA-59f3-vp2f-mp9w

medium2026-05-28

CVE-2026-45754-Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

symfony/symfony · GHSA-64hg-93w9-fc35