Security advisories

low2026-05-14

CVE-2026-44969-dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled

dbt-labs/dbt-mcp · GHSA-7xgw-6qf3-7w59

medium2026-05-14

CVE-2026-44968-dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

dbt-labs/dbt-mcp · GHSA-xpww-f6pm-cfhq

medium2026-05-14

TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function

tanstack/router · GHSA-9m65-766c-r333

medium2026-05-14

CVE-2026-44899-Mistune Image Directive CSS Injection Vulnerability

lepture/mistune · GHSA-ccfx-mfmx-2fx9

medium2026-05-14

CVE-2026-44898-Mistune TOC Anchor Injection XSS

lepture/mistune · GHSA-6269-cqxg-mhhv

medium2026-05-14

CVE-2026-45292-OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation

open-telemetry/opentelemetry-java · GHSA-rcgg-9c38-7xpx

medium2026-05-14

CVE-2026-44884-Portainer missing authorization on custom template file endpoint, which exposes template content

portainer/portainer · GHSA-cqpq-2fgr-8mvc

high2026-05-14

CVE-2026-44883-Portainer: JWT accepted in URL query leaks tokens to logs and referers

portainer/portainer · GHSA-jvp4-q659-95mj

critical2026-05-14

CVE-2026-44849-Portainer has an endpoint security bypass via Swarm service create/update

portainer/portainer · GHSA-5fxq-qcf3-244w

high2026-05-14

CVE-2026-44882-Portainer's Kubernetes middleware continues after token validation failure, bypassing endpoint authorization

portainer/portainer · GHSA-mgq6-4x29-88r3

high2026-05-14

CVE-2026-44881-Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

portainer/portainer · GHSA-rpgq-m5fp-32wr

high2026-05-14

CVE-2026-44850-Portainer has a bind-mount restriction bypass via HostConfig.Mounts

portainer/portainer · GHSA-7fw3-x4r2-g7wc

medium2026-05-14

CVE-2026-44885-Portainer has a path traversal in backup archive extraction that allows arbitrary file write

portainer/portainer · GHSA-m8fg-67j7-cx4v

critical2026-05-14

CVE-2026-44848-Portainer missing authorization on Docker plugin endpoints, which allows host RCE

portainer/portainer · GHSA-rrmm-9v76-h3p4

high2026-05-14

CVE-2026-46480-FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover

flowiseai/flowise · GHSA-wxrr-jp8m-qq7f

high2026-05-14

CVE-2026-46479-FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover

flowiseai/flowise · GHSA-mq53-pc65-wjc4

high2026-05-14

CVE-2026-46478-FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover

flowiseai/flowise · GHSA-7j65-65cr-6644

high2026-05-14

CVE-2026-46477-FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover

flowiseai/flowise · GHSA-5h9v-837x-m97r

high2026-05-14

CVE-2026-46476-FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover

flowiseai/flowise · GHSA-728h-4mwj-f2p4

high2026-05-14

CVE-2026-46475-FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover

flowiseai/flowise · GHSA-78pr-c5x5-jggc