Security advisories

low2026-05-05

CVE-2026-42874-Microdot has HTTP response splitting in Response.set_cookie()

miguelgrinberg/microdot · GHSA-7wc8-wvc4-m498

medium2026-05-05

CVE-2026-43002-OpenStack Horizon has Incorrect Behavior Order

openstack/horizon · GHSA-vxvf-xvm3-p8j5

low2026-05-05

CVE-2026-7847-Langchain-Chatchat Uses Insufficiently Random Values

chatchat-space/langchain-chatchat · GHSA-jv4p-mhmp-69vw

low2026-05-05

CVE-2026-7846-Langchain-Chatchat has a Race Condition in its OpenAI-Compatible File Upload API

chatchat-space/langchain-chatchat · GHSA-x229-w2j4-h748

low2026-05-05

CVE-2026-7845-Langchain-Chatchat Uses a Broken or Risky Cryptographic Algorithm

chatchat-space/langchain-chatchat · GHSA-wmvv-fhm6-w34x

medium2026-05-05

CVE-2026-5766-Django has an Improper Handling of Length Parameter Inconsistency

django/django · GHSA-w26r-rmm8-9c29

high2026-05-05

CVE-2026-7412-Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery

eclipse-basyx/basyx-java-sdk · GHSA-gx3v-wxfj-8h24

critical2026-05-05

CVE-2026-7411-Eclipse BaSyx Java Server SDK vulnerable to Path Traversal

eclipse-basyx/basyx-java-sdk · GHSA-8gpm-h2mh-36qc

low2026-05-05

CVE-2026-6907-Django Uses Cache Containing Sensitive Information

django/django · GHSA-5hrc-gvxj-w55p

low2026-05-05

CVE-2026-35192-Django Uses Persistent Cookies Containing Sensitive Information

django/django · GHSA-7h2m-m8vj-598h

critical2026-05-05

CVE-2026-42048-Langflow Knowledge Bases API is Vulnerable to Path Traversal

langflow-ai/langflow · GHSA-9whx-c884-c68q

high2026-05-05

@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin

tdurieux/anonymous_github · GHSA-g485-8j3v-p6x8

medium2026-05-05

CVE-2026-41417-Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection

netty/netty · GHSA-v8h7-rr48-vmmv

critical2026-05-05

CVE-2026-42864-FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

manomanotech/firefighter-incident · GHSA-fqvv-jvhr-g5jc

high2026-05-05

CVE-2026-42047-Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods

inngest/inngest-js · GHSA-2jf5-6wwv-vhxx

medium2026-05-05

CVE-2026-40864-JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)

jupyterhub/jupyterhub · GHSA-m68r-v472-jgq9

high2026-05-05

Diesel's SQLite backend has possible UTF-8 corruption

diesel-rs/diesel · GHSA-h5x4-m2qf-r4f2

medium2026-05-05

CVE-2026-42045-LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution

lobehub/lobehub · GHSA-xq4x-622m-q8fq

critical2026-05-05

CVE-2026-25660-Codechecker has an authentication bypass for certain API calls

ericsson/codechecker · GHSA-4v9x-cqc5-j645

high2026-05-05

CVE-2026-42860-edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint

openedx/edx-enterprise · GHSA-64cv-vxpr-j6vc