Security advisories

medium2026-05-06

CVE-2026-44437-Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

angular/angular-cli · GHSA-69xr-m8h6-h664

high2026-05-06

ldap3_proto has LDAP Filter stack exhaustion

kanidm/ldap3 · GHSA-qcxq-75wr-5cm8

medium2026-05-06

kanidmd_lib: Image upload validators run before authorization; PNG validator panics on malformed input

kanidm/kanidm · GHSA-84jc-3hj2-hwc7

high2026-05-06

CVE-2026-46689-scim_proto and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion

kanidm/kanidm · GHSA-r5fr-9gmv-jggh

low2026-05-06

Kanidm has non-constant-time comparison of OAuth2 client_secret

kanidm/kanidm · GHSA-53hj-r94p-8c8f

medium2026-05-06

Kanidm: Stored HTML injection in "passkey-enrolment" partial via displayname → htmx-driven authenticated request forgery

kanidm/kanidm · GHSA-gpxg-fx2g-qxj2

low2026-05-06

webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed

kanidm/webauthn-rs · GHSA-22w3-693w-x895

medium2026-05-06

CVE-2026-44425-ShellHub has crash-DoS via field injection in filter and sort-by parameters

shellhub-io/shellhub · GHSA-47r2-v3x6-wff9

medium2026-05-06

@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening

getaxonflow/axonflow-openclaw-plugin · GHSA-cqmh-pcgr-q42f

medium2026-05-06

CVE-2026-44423-ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data

shellhub-io/shellhub · GHSA-9w9c-9w8m-w89q

medium2026-05-06

CVE-2026-44424-ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace

shellhub-io/shellhub · GHSA-j72x-xfwg-783f

medium2026-05-06

axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

getaxonflow/axonflow-sdk-java · GHSA-248h-974q-xrc2

medium2026-05-06

axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

getaxonflow/axonflow-sdk-typescript · GHSA-mph8-9v29-pm42

medium2026-05-06

axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

getaxonflow/axonflow-sdk-go · GHSA-mhc4-qq83-fmrr

medium2026-05-06

axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

getaxonflow/axonflow-sdk-python · GHSA-7f4h-6264-89fr

critical2026-05-06

Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening

getaxonflow/axonflow · GHSA-9h64-2846-7x7f

high2026-05-06

CVE-2026-42577-Netty epoll transport denial of service via RST on half-closed TCP connection

netty/netty · GHSA-rwm7-x88c-3g2p

high2026-05-06

CVE-2026-0897-Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)

keras-team/keras · GHSA-mgx6-5cf9-rr43

high2026-05-06

CVE-2026-44375-Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException

aarnott/nerdbank.messagepack · GHSA-2cwq-pwfr-wcw3

medium2026-05-06

CVE-2026-44374-Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

backstage/backstage · GHSA-p7g9-rp3g-mgfg