Security advisories

critical2026-05-07

CVE-2026-44006-vm2 has a Sandbox Escape Vulnerability

patriksimek/vm2 · GHSA-qcp4-v2jj-fjx8

medium2026-05-07

CVE-2026-42788-Bandit HTTP/2 Frame Size Limit Bypass via Late Buffer Check Enables Memory Exhaustion

mtrudel/bandit · GHSA-q6v9-r226-v65f

medium2026-05-07

CVE-2026-39807-Bandit trusts client-supplied URI scheme on plaintext connections

mtrudel/bandit · GHSA-375f-4r2h-f99j

medium2026-05-07

CVE-2026-39805-Bandit is vulnerable to CL.CL request smuggling via unrejected duplicate `Content-Length` header

mtrudel/bandit · GHSA-c67r-gc9j-2qf7

high2026-05-07

CVE-2026-42786-Bandit Buffers Unbounded WebSocket Continuation Frames, Allowing Unauthenticated Memory Exhaustion

mtrudel/bandit · GHSA-pf94-94m9-536p

high2026-05-07

CVE-2026-39804-Bandit's unbounded WebSocket inflate causes BEAM OOM with a single frame

mtrudel/bandit · GHSA-frh3-6pv6-rc8j

medium2026-05-07

CVE-2026-44544-gittuf's policy can be rolled back to prior valid versions

gittuf/gittuf · GHSA-vxvc-cg7j-rwqj

medium2026-05-07

FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

gtsteffaniak/filebrowser · GHSA-mmpx-jh39-wrv6

critical2026-05-07

CVE-2026-44542-FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

gtsteffaniak/filebrowser · GHSA-fwj3-42wh-8673

low2026-05-07

CVE-2026-44283-etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests

etcd-io/etcd · GHSA-x35m-3gp4-4fh5

medium2026-05-07

CVE-2026-44520-docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler

docling-project/docling-graph · GHSA-fqph-j6v6-jvgx

medium2026-05-07

imageproc: integer overflow in kernel size check leads to out-of-bounds read

image-rs/imageproc · GHSA-w5p8-4jcx-2j6r

medium2026-05-07

imageproc: Out-of-bounds read via NaN coordinates in bilinear/bicubic sampling

image-rs/imageproc · GHSA-qg8r-f7x3-25f7

medium2026-05-07

imageproc has fragile bounds check when sampling from image

image-rs/imageproc · GHSA-5qv7-j6w5-fr4m

medium2026-05-07

CVE-2026-44426-ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check

shellhub-io/shellhub · GHSA-vwx9-7qcf-gg7f

medium2026-05-07

hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) name compression

hickory-dns/hickory-dns · GHSA-q2qq-hmj6-3wpp

high2026-05-07

hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

hickory-dns/hickory-dns · GHSA-3v94-mw7p-v465

medium2026-05-07

Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change

daptin/daptin · GHSA-258c-965c-p3hc

high2026-05-07

Talos Linux has a local privilege escalation from untrusted workloads

siderolabs/talos · GHSA-m38g-vww2-mvgx

medium2026-05-07

CVE-2026-44514-Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users

kubetail-org/kubetail · GHSA-v8j7-hp7c-738f