Security advisories

low2026-05-21

androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers)

mvt-project/androidqf · GHSA-jf2q-463c-6f52

medium2026-05-21

CVE-2026-46486-Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing

mvt-project/mvt · GHSA-5h3g-px23-w6vw

medium2026-05-21

CVE-2026-46403-Klever-Go KVM read-only execution can commit contract delete and upgrade side effects

klever-io/klever-go · GHSA-jc6w-wmfc-fh33

high2026-05-21

CVE-2026-48989-Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

cursortouch/windows-mcp · GHSA-vrxg-gm77-7q5g

high2026-05-21

CVE-2026-46481-OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users

open-metadata/openmetadata · GHSA-9vmh-whc4-7phg

high2026-05-21

CVE-2026-45760-Apache Camel K: Kubernetes namespace authorized users can create a Build resource

apache/camel-k · GHSA-q8ch-jx67-q52x

high2026-05-21

CVE-2026-4858-Mattermost has a Path Traversal issue

mattermost/mattermost · GHSA-c4r7-j7pp-r8mp

medium2026-05-21

CVE-2026-4055-Mattermost has an Incorrect Authorization issue

mattermost/mattermost · GHSA-6cfr-wp44-6qmv

medium2026-05-21

CVE-2026-2734-MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks

mlflow/mlflow · GHSA-w5xq-c4pf-ghq7

critical2026-05-20

CVE-2026-9082-Drupal Core has a SQL Injection issue

drupal/core · GHSA-ghwc-95x2-682j

medium2026-05-20

CVE-2026-9087-Keycloak: Insufficient verification proof scoping enables identity provider account linking attack and account compromise

keycloak/keycloak · GHSA-m6qj-3mpp-57v8

medium2026-05-20

CVE-2026-30691-@cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode

cyntler/react-doc-viewer · GHSA-fvhg-p4hf-79x3

high2026-05-20

CVE-2026-35675-phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration

thorsten/phpmyfaq · GHSA-w9xh-5f39-vq89

high2026-05-20

CVE-2026-35672-phpMyFAQ: Default Empty API Token Authentication Bypass

thorsten/phpmyfaq · GHSA-gp95-j463-vv28

high2026-05-20

CVE-2026-35671-phpMyFAQ: IDOR Account Takeover

thorsten/phpmyfaq · GHSA-xvp4-phqj-cjr3

high2026-05-20

CVE-2026-35676-phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation

thorsten/phpmyfaq · GHSA-9qv9-8xv6-5p35

medium2026-05-20

CVE-2026-56268-Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows

flowiseai/flowise · GHSA-c2c9-mfw7-p8hw

medium2026-05-20

Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification

flowiseai/flowise · GHSA-59fh-9f3p-7m39

medium2026-05-20

Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage

flowiseai/flowise · GHSA-m837-xvxr-vqwg

high2026-05-20

wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None

wger-project/wger · GHSA-mw8f-w6p8-xrf4