Security advisories

medium2026-05-18

CVE-2026-45681-OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size

open-telemetry/opentelemetry-ebpf-instrumentation · GHSA-r6c9-g6q5-qrf9

medium2026-05-18

CVE-2026-45680-OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU

open-telemetry/opentelemetry-ebpf-instrumentation · GHSA-89c6-vpcj-7vj4

high2026-05-18

CVE-2026-35433-Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability

dotnet/wpf · GHSA-8x9c-mqxv-q2pp

high2026-05-18

CVE-2026-42899-Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability

dotnet/aspnetcore · GHSA-9v76-4qcc-frgh

high2026-05-18

CVE-2026-32175-Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability

dotnet/runtime · GHSA-rg75-q538-x34v

medium2026-05-18

CVE-2026-45736-ws: Uninitialized memory disclosure

websockets/ws · GHSA-58qx-3vcg-4xpx

medium2026-05-18

CVE-2026-45731-AVideo: Authenticated Arbitrary File Read in view/update.php

wwbn/avideo · GHSA-3mjv-375j-6h92

critical2026-05-18

CVE-2026-45829-ChromaDB Python project has a pre-authentication code injection vulnerability

chroma-core/chroma · GHSA-f4j7-r4q5-qw2c

high2026-05-18

CVE-2025-57282-ngrok is Vulnerable to Command Injection

bubenshchykov/ngrok · GHSA-qr28-p3wr-mxq3

high2026-05-18

CVE-2026-45678-OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

open-telemetry/opentelemetry-ebpf-instrumentation · GHSA-pgvv-q3wf-mm9m

medium2026-05-18

CVE-2026-45679-OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

open-telemetry/opentelemetry-ebpf-instrumentation · GHSA-8rrq-wcg8-cv5q

medium2026-05-18

CVE-2026-45676-OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

open-telemetry/opentelemetry-ebpf-instrumentation · GHSA-wp73-mwgf-4jq9

low2026-05-18

Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp

mistralai/client-ts · GHSA-jgg6-4rpr-wfh7

critical2026-05-18

Malicious dropper in mistralai 2.4.6 PyPI package

mistralai/client-python · GHSA-wx9m-wx4f-4cmg

medium2026-05-18

CVE-2026-45031-ImageMagick: Policy Bypass in PSD decoder

imagemagick/imagemagick · GHSA-cwpj-h54c-xjpx

high2026-05-18

CVE-2026-32687-Postgrex: Channel-name SQL injection in `Postgrex.Notifications.listen/3`

elixir-ecto/ecto · GHSA-r73h-97w8-m54h

high2026-05-18

CVE-2026-42306-Docker: Race condition in docker cp allows bind mount redirection to host path

moby/moby · GHSA-rg2x-37c3-w2rh

medium2026-05-18

CVE-2026-41568-Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

moby/moby · GHSA-vp62-88p7-qqf5

high2026-05-18

CVE-2026-45727-CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

cloakhq/cloakbrowser · GHSA-mf33-gv72-w2h5

medium2026-05-18

CVE-2026-45358-ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

imagemagick/imagemagick · GHSA-cr6r-hmj8-pr7r