Security advisories

high2026-05-04

CVE-2026-41893-Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

signalk/signalk-server · GHSA-vmfm-ch9h-5c7g

medium2026-05-04

CVE-2026-41891-CI4MS has a Deactivated User Session Bypass (active=0)

ci4-cms-erp/ci4ms · GHSA-5hfv-c864-qcq9

medium2026-05-04

CVE-2026-41890-CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess

ci4-cms-erp/ci4ms · GHSA-vgrf-pr28-vf98

medium2026-05-04

CVE-2026-41888-Distribution's tag deletion bypasses `storage.delete.enabled` configuration

distribution/distribution · GHSA-6pjf-3r9x-m592

medium2026-05-04

OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs

openclaw/openclaw · GHSA-x3h8-jrgh-p8jx

high2026-05-04

CVE-2026-44118-OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

openclaw/openclaw · GHSA-r6xh-pqhr-v4xh

medium2026-05-04

CVE-2026-45003-OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

openclaw/openclaw · GHSA-55cf-xx38-4p9p

medium2026-05-04

CVE-2026-44997-OpenClaw's ACP child sessions inherit subagent security envelope constraints

openclaw/openclaw · GHSA-q3jj-46pq-826r

medium2026-05-04

CVE-2026-44116-OpenClaw validates Zalo outbound photo URLs through the SSRF guard

openclaw/openclaw · GHSA-2hh7-c75g-qj2r

high2026-05-04

CVE-2026-42311-Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

python-pillow/pillow · GHSA-pwv6-vv43-88gr

medium2026-05-04

CVE-2026-42310-Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

python-pillow/pillow · GHSA-r73j-pqj5-w3x7

medium2026-05-04

CVE-2026-42308-Pillow has an integer overflow when processing fonts

python-pillow/pillow · GHSA-wjx4-4jcj-g98j

medium2026-05-04

CVE-2026-42309-Pillow has a heap buffer overflow with nested list coordinates

python-pillow/pillow · GHSA-5xmw-vc9v-4wf2

high2026-05-04

CVE-2026-42301-pyp2spec is Vulnerable to Code Injection

befeleme/pyp2spec · GHSA-r35x-v8p8-xvhw

high2026-05-04

CVE-2026-42295-Argo vulnerable to exposure of artifact repository credentials

argoproj/argo-workflows · GHSA-7vf8-2cr6-54mf

high2026-05-04

CVE-2026-42296-Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

argoproj/argo-workflows · GHSA-3775-99mw-8rp4

high2026-05-04

CVE-2026-42294-Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

argoproj/argo-workflows · GHSA-jcc8-g2q4-9fxq

low2026-05-04

CVE-2026-42183-Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

argoproj/argo-workflows · GHSA-p4gq-3vxj-f4jq

high2026-05-04

CVE-2026-42297-Argo has Missing Authorization in its Sync ConfigMap Provider

argoproj/argo-workflows · GHSA-xchc-cqwg-g76q

medium2026-05-04

CVE-2026-42051-Kirby CMS's system API endpoint leaks installed version and license data to authenticated users

getkirby/kirby · GHSA-x68m-c7jf-2572