Security advisories

low2026-05-28

CVE-2026-45287-opentelemetry-go's Schema ParseFile leaks file descriptors on each parse

open-telemetry/opentelemetry-go · GHSA-995v-fvrw-c78m

medium2026-05-28

CVE-2026-41178-opentelemetry-go's baggage parsing no longer caps raw header length

open-telemetry/opentelemetry-go · GHSA-5wrp-cwcj-q835

medium2026-05-28

CVE-2026-22872-Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

projectcapsule/capsule · GHSA-qjjm-7j9w-pw72

low2026-05-28

CVE-2026-30963-Capsule Namespace Hijacking via subresource

projectcapsule/capsule · GHSA-2ww6-hf35-mfjm

low2026-05-28

CVE-2026-45753-Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)

symfony/symfony · GHSA-hhg7-c65m-h7ff

medium2026-05-28

CVE-2026-40914-Apache Artemis has an Incorrect Authorization issue

apache/artemis · GHSA-rf99-f9j2-gv3f

low2026-05-28

CVE-2026-9828-QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability

qos-ch/logback · GHSA-p47f-322f-whfh

high2026-05-28

CVE-2025-48977-Apache Ignite REST API Has a Relative Path Traversal Vulnerability

apache/ignite · GHSA-v45h-mqf4-6939

high2026-05-28

CVE-2026-9804-KubeVirt has a Link Following issue

kubevirt/kubevirt · GHSA-mpmf-3w4r-qfpf

medium2026-05-28

CVE-2026-9802-Keycloak has Insufficient Session Expiration

keycloak/keycloak · GHSA-v5g5-wwmp-jppw

medium2026-05-28

CVE-2026-9801-Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

keycloak/keycloak · GHSA-f6r7-6w34-x2gp

medium2026-05-28

CVE-2026-9803-Keycloak has an Out-of-bounds Read

keycloak/keycloak · GHSA-cpf7-j4cf-vqx4

medium2026-05-28

CVE-2026-9798-Keycloak has an Authentication Bypass by Primary Weakness

keycloak/keycloak · GHSA-q6h7-xxp7-7429

medium2026-05-28

CVE-2026-9796-Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition

keycloak/keycloak · GHSA-pq65-77rc-7r8c

medium2026-05-28

CVE-2026-9793-Keycloak has an Improper Verification of Cryptographic Signature issue

keycloak/keycloak · GHSA-p3v8-fm5p-v84h

medium2026-05-28

CVE-2026-9673-json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio

mrodrig/json-2-csv · GHSA-g27c-q7cp-mhx6

medium2026-05-28

CVE-2026-9794-Keycloak Generates an Error Message Containing Sensitive Information

keycloak/keycloak · GHSA-fqjh-8322-vgrv

medium2026-05-28

CVE-2026-9791-Keycloak Vulnerable to Incorrect Authorization

keycloak/keycloak · GHSA-4q93-v92x-p89f

medium2026-05-28

CVE-2026-9792-Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege

keycloak/keycloak · GHSA-33j3-g875-37rp

critical2026-05-28

CVE-2026-9739-MCP Toolbox for Databases vulnerable to DNS rebinding attacks

googleapis/mcp-toolbox · GHSA-7pf3-8xx7-rvhf