Security advisories

high2026-05-11

CVE-2026-44340-PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`

mervinpraison/praisonai · GHSA-9q28-ghcr-c4x3

high2026-05-11

CVE-2026-44339-PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute

mervinpraison/praisonai · GHSA-gmjg-hv98-qggq

critical2026-05-11

CVE-2026-44336-PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection

mervinpraison/praisonai · GHSA-9mqq-jqxf-grvw

medium2026-05-11

CVE-2026-44337-PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

mervinpraison/praisonai · GHSA-3643-7v76-5cj2

high2026-05-11

CVE-2026-44338-PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

mervinpraison/praisonai · GHSA-6rmh-7xcm-cpxj

high2026-05-11

CVE-2026-42595-Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass

gotenberg/gotenberg · GHSA-chwh-f6gm-r836

medium2026-05-11

CVE-2026-43826-Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL

apache/airflow · GHSA-xccp-97wp-3gjg

medium2026-05-11

CVE-2026-41018-Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL

apache/airflow · GHSA-g3jr-4jrm-jvqv

low2026-05-11

CVE-2026-8276-bettercap Has an Integer Coercion Error in modules/mysql_server/mysql_server.go

bettercap/bettercap · GHSA-jcqv-2g3v-gm88

low2026-05-11

CVE-2026-8275-bettercap Has an Integer Coercion Error in the ippReadChunkedBody Function

bettercap/bettercap · GHSA-322p-rrj6-j44g

high2026-05-10

CVE-2021-47935-Sentry: Superusers can execute arbitrary commands by injecting malicious pickle-serialized objects through audit log entry data parameter

getsentry/sentry · GHSA-444r-2whx-3685

low2026-05-10

CVE-2026-8212-OSGeo gdal has a heap-based buffer overflow

osgeo/gdal · GHSA-r5m4-5vww-w9f5

high2026-05-09

CVE-2026-41705-Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs

spring-projects/spring-ai · GHSA-v632-2m87-7469

medium2026-05-09

CVE-2026-44458-Hono has CSS Declaration Injection via Style Object Values in JSX SSR

honojs/hono · GHSA-qp7p-654g-cw7p

low2026-05-09

CVE-2026-44459-Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

honojs/hono · GHSA-hm8q-7f3q-5f36

critical2026-05-09

@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module

profullstack/mcp-server · GHSA-v6wj-c83f-v46x

high2026-05-09

CVE-2026-44966-Velocity.js has a Prototype Pollution vulnerability through #set path assignment

shepherdwind/velocity.js · GHSA-j658-c2gf-x6pq

medium2026-05-09

CVE-2026-6860-Vert.x has a DoS via unbounded server-side SNI SslContext cache growth

eclipse-vertx/vert.x · GHSA-3g76-f9xq-8vp6

medium2026-05-09

CVE-2026-44457-Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

honojs/hono · GHSA-p77w-8qqv-26rm

medium2026-05-09

CVE-2026-44897-Mistune Heading ID Attribute has Injection XSS

lepture/mistune · GHSA-v87v-83h2-53w7