Security advisories

critical2026-05-12

CVE-2026-31239-mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub

state-spaces/mamba · GHSA-pq2f-x424-6fjm

high2026-05-12

CVE-2026-31240-mem0 server lacks authentication and authorization controls for its memory management API endpoints

mem0ai/mem0 · GHSA-jfv9-68m5-gjjr

medium2026-05-12

CVE-2026-31241-mem0 server lacks authentication and authorization controls for its memory deletion API endpoint

mem0ai/mem0 · GHSA-gq6f-qwv9-rf4j

critical2026-05-12

CVE-2026-31235-imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module

aleju/imgaug · GHSA-g82g-j283-hj97

critical2026-05-12

CVE-2026-31236-llm CLI tool contains a code injection vulnerability via `--functions` command-line argument

simonw/llm · GHSA-g76p-4vg5-f4qh

medium2026-05-12

CVE-2026-31245-mem0 server lacks authentication and authorization controls for its memory creation API endpoint

mem0ai/mem0 · GHSA-cgx8-qgvr-f7vf

critical2026-05-12

CVE-2026-31233-Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism

guardrails-ai/guardrails · GHSA-r6hf-g5x6-7pv9

critical2026-05-12

CVE-2026-31234-Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component

horovod/horovod · GHSA-mf8f-x4r3-jm8c

critical2026-05-12

CVE-2026-41293-Apache Tomcat - HTTP/2 request headers not validated

apache/tomcat · GHSA-r29c-68gh-xp6x

high2026-05-12

CVE-2026-41284-Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

apache/tomcat · GHSA-gx5v-xp9w-j4cg

high2026-05-12

CVE-2026-31224-Snorkel MultitaskClassifier.load uses an unsafe torch.load

snorkel-team/snorkel · GHSA-gpx5-7xm4-229w

high2026-05-12

CVE-2026-42498-Apache Tomcat - WebSocket authentication header exposure

apache/tomcat · GHSA-fv25-8xcx-gqjc

high2026-05-12

CVE-2026-31223-Snorkel BaseLabeler.load uses an unsafe pickle.load

snorkel-team/snorkel · GHSA-fq92-qc8f-482v

critical2026-05-12

CVE-2026-31220-PySyft server-side arbitrary Python execution after code approval

openmined/pysyft · GHSA-cfpg-c974-jfhq

low2026-05-12

CVE-2026-43514-Apache Tomcat - AJP secret compared in non-constant time

apache/tomcat · GHSA-9m89-8frq-c98c

critical2026-05-12

CVE-2025-65719-Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

rohitg00/kubectl-mcp-server · GHSA-94gr-w3q5-rfqr

high2026-05-12

CVE-2026-31222-Snorkel Trainer.load uses an unsafe torch.load

snorkel-team/snorkel · GHSA-78cp-f66x-qmh5

high2026-05-12

CVE-2026-31221-PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

lightning-ai/pytorch-lightning · GHSA-75m9-98v2-hjpm

high2026-05-12

CVE-2026-43513-Apache Tomcat: LockOutRealm treats user names as case-sensitive

apache/tomcat · GHSA-5mp6-jrq3-r938

critical2026-05-12

CVE-2026-43515-Apache Tomcat - Security constraints not correctly applied

apache/tomcat · GHSA-5m62-pw8w-7w9f