Security advisories

low2026-05-26

CVE-2026-9497-TCC-TRANSACTION has an Improper Input Validation vulnerability

changmingxie/tcc-transaction · GHSA-4r4v-3jc5-hrg9

medium2026-05-26

CVE-2026-42797-Apache Syncope Vulnerable to Exposure of Sensitive Information Through Data Queries

apache/syncope · GHSA-vr35-jm2f-8wg2

medium2026-05-26

CVE-2026-46745-Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability

apache/airflow · GHSA-g283-w6fp-c4fc

high2026-05-26

CVE-2026-45361-Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default

apache/airflow · GHSA-g9v5-gjwf-9rwx

medium2026-05-26

CVE-2026-45249-Apache ECharts has a cross-site scripting (XSS) vulnerability

apache/echarts · GHSA-fgmj-fm8m-jvvx

medium2026-05-26

CVE-2026-4915-Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing

mattermost/mattermost · GHSA-5gmf-x7hg-97wf

medium2026-05-26

CVE-2026-41863-Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk

spring-projects/spring-ai · GHSA-cc4m-mp48-x7qg

critical2026-05-26

CVE-2026-2651-MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled

mlflow/mlflow · GHSA-8c7q-86fq-vvmh

high2026-05-26

CVE-2026-4372-HuggingFace transformers vulnerable to remote code execution

huggingface/transformers · GHSA-29pf-2h5f-8g72

medium2026-05-26

CVE-2026-9368-hermes-agent has a sandbox issue

nousresearch/hermes-agent · GHSA-wm96-9gfh-vvgq

low2026-05-26

CVE-2026-9370-jasypt-spring-boot Uses a One-Way Hash without a Salt

ulisesbocchio/jasypt-spring-boot · GHSA-jgj7-c8vj-w563

low2026-05-26

CVE-2026-9369-hermes-agent has an Incorrect Comparison

nousresearch/hermes-agent · GHSA-cv5c-mh6j-wvp9

medium2026-05-26

CVE-2026-9366-hermes-agent has an Injection issue

nousresearch/hermes-agent · GHSA-pgp4-xr4j-h5cg

low2026-05-26

CVE-2026-9358-postcss-selector-parser allows denial of service through uncontrolled AST recursion

postcss/postcss-selector-parser · GHSA-w9m9-85wc-3x92

medium2026-05-26

CVE-2026-9353-hermes-agent has an Injection issue

nousresearch/hermes-agent · GHSA-238w-f66p-w349

high2026-05-26

CVE-2026-3515-Prefect has an Argument Injection issue

prefecthq/prefect · GHSA-cw25-2p92-7f75

critical2026-05-26

CVE-2018-25357-Dolibarr ERP CRM contains a remote code evaluation vulnerability

dolibarr/dolibarr · GHSA-hxmh-2xc4-c894

low2026-05-26

CVE-2026-9301-omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

omec-project/amf · GHSA-qm7q-rcm2-3frc

low2026-05-26

CVE-2026-9299-omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

omec-project/amf · GHSA-m9r6-r5c3-jw4j

low2026-05-26

CVE-2026-9300-omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

omec-project/amf · GHSA-6p7m-c3mw-4gmw