Security advisories

high2026-05-14

CVE-2026-42861-FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment

flowiseai/flowise · GHSA-6fw7-3q8r-m5vj

medium2026-05-14

CVE-2026-46356-Fleet: IP spoofing allows bypassing API rate limiting

fleetdm/fleet · GHSA-mxmp-wr3w-rvqx

high2026-05-14

CVE-2026-41249-CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration

coreshop/coreshop · GHSA-q58j-g3f4-h26h

critical2026-05-14

CVE-2026-27886-Strapi may leak sensitive data via relational filtering due to lack of query sanitization

strapi/strapi · GHSA-rjg2-95x7-8qmx

medium2026-05-14

CVE-2026-26191-Fleet vulnerable to OS command injection in software packages

fleetdm/fleet · GHSA-9vcr-g537-3w5v

high2026-05-14

CVE-2026-26062-Fleet server may terminate unexpectedly when handling certain gRPC requests

fleetdm/fleet · GHSA-x67p-9m2r-fxqv

high2026-05-14

CVE-2026-24899-Fleet Windows MDM Azure AD JWT Authentication Bypass

fleetdm/fleet · GHSA-ffg9-j72f-j6xm

medium2026-05-14

CVE-2026-24000-Fleet has a rate limiting bypass via untrusted client IP headers

fleetdm/fleet · GHSA-j8h8-75h3-jg53

high2026-05-14

CVE-2026-23998-Fleet has a Windows MDM management endpoint authentication bypass

fleetdm/fleet · GHSA-2rc4-7jc6-qffh

medium2026-05-14

CVE-2026-22707-Strapi Upload Plugin MIME Validation Bypass via Content API

strapi/strapi · GHSA-pcw7-5633-82vv

critical2026-05-14

CVE-2026-8178-Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading

aws/amazon-redshift-jdbc-driver · GHSA-wmmv-vvg5-993q

high2026-05-14

CVE-2026-43967-Absinthe: Quadratic fragment-name uniqueness check

absinthe-graphql/absinthe · GHSA-9mhv-8h52-q7q2

high2026-05-14

CVE-2026-42793-Absinthe: Unbounded atom creation from parsed directive name

absinthe-graphql/absinthe · GHSA-qf4g-9fqq-mmm7

medium2026-05-14

CVE-2026-45205-Apache Commons Configuration: StackOverflowError for YAML input with cycles

apache/commons-configuration · GHSA-337m-mw94-2v6g

medium2026-05-13

CVE-2026-33381-Grafana: Users can generate Service Account tokens after permissions removal

grafana/grafana · GHSA-wfhv-mj62-f5xh

high2026-05-13

CVE-2026-8466-Cowboy: Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy

ninenines/cowboy · GHSA-jfc2-q6qh-g5x8

medium2026-05-13

CVE-2026-33380-Grafana: SQL Expressions Read File From Disk

grafana/grafana · GHSA-gxcp-jjxh-rwp4

high2026-05-13

CVE-2026-43970-cowlib: Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

ninenines/cowlib · GHSA-84f2-rp86-235p

low2026-05-13

CVE-2026-22706-Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

strapi/strapi · GHSA-hvp3-26wx-g2w4

critical2026-05-13

CVE-2026-22599-Strapi Vulnerable to SQL Injection in Content Type Builder

strapi/strapi · GHSA-3xcq-8mjw-h6mx