Security advisories

medium2026-05-07

CVE-2026-44514-Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users

kubetail-org/kubetail · GHSA-v8j7-hp7c-738f

high2026-05-07

CVE-2026-44511-katalyst-koi: Session cookies can be replayed after user logout

katalyst/koi · GHSA-4cx3-3c38-j9vv

high2026-05-07

CVE-2026-42459-Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information

free5gc/free5gc · GHSA-585v-hcgf-jhfr

medium2026-05-07

CVE-2026-42328-go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth

ipld/go-ipld-prime · GHSA-w239-58x2-q8p5

medium2026-05-07

CVE-2026-44312-CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content

premailer/css_parser · GHSA-ff6c-w6qf-7xqc

high2026-05-07

CVE-2026-42083-Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI

free5gc/free5gc · GHSA-6rgm-gr97-x3j5

critical2026-05-07

CVE-2026-42880-ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

argoproj/argo-cd · GHSA-3v3m-wc6v-x4x3

low2026-05-07

CVE-2026-42082-Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover

free5gc/free5gc · GHSA-vrrx-58h3-prmh

high2026-05-07

rust-zserio has Unbounded Memory Allocation

danaozhong/rust-zserio · GHSA-fpf5-4jw8-67x8

medium2026-05-07

CVE-2026-42081-Free5GC AMF Bypasses UE Security Capabilities on NGAP PathSwitchRequest

free5gc/free5gc · GHSA-77x9-rf64-92gv

high2026-05-07

CVE-2026-44504-Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)

aegra/aegra · GHSA-m98r-6667-4wq7

high2026-05-07

CVE-2026-44503-Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

microsoft/kiota-java · GHSA-7j59-v9qr-6fq9

low2026-05-07

container: pf Rule Injection via Domain Name Argument in `container system dns create --localhost` Command

apple/container · GHSA-39g5-644c-qwcg

critical2026-05-07

CVE-2026-41050-Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

rancher/fleet · GHSA-765j-qfrp-hm3j

high2026-05-07

CVE-2026-25705-Rancher Extensions have arbitrary file access via path traversal

rancher/rancher · GHSA-5v3h-x4wf-5c35

high2026-05-07

Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure

aws/amazon-ecs-agent · GHSA-fc67-c4hg-q653

medium2026-05-07

CVE-2026-42597-Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme

gotenberg/gotenberg · GHSA-g924-cjx7-2rjw

critical2026-05-07

CVE-2026-42596-Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

gotenberg/gotenberg · GHSA-4vmc-gm8v-m35h

high2026-05-07

CVE-2026-42594-Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine

gotenberg/gotenberg · GHSA-r33j-c622-r6qp

medium2026-05-07

CVE-2026-42593-Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes

gotenberg/gotenberg · GHSA-3cv5-q585-h563