Security advisories

medium2026-05-04

CVE-2026-42174-Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions

getkirby/kirby · GHSA-39cp-6679-8xv2

high2026-05-04

CVE-2026-42069-Kirby CMS's read access to site, user and role information is not gated by permissions

getkirby/kirby · GHSA-2h7v-4372-f6x2

medium2026-05-04

CVE-2026-41685-Incus is affected by unbounded binary import disk exhaustion

lxc/incus · GHSA-98vh-x9cx-9cfp

medium2026-05-04

CVE-2026-41684-Incus has Nil Dereferences on Restore via Malformed YAML

lxc/incus · GHSA-x5r6-jr56-89pv

medium2026-05-04

CVE-2026-41648-Incus has Unbounded YAML Metadata Decode via Parsing

lxc/incus · GHSA-67wx-r9xr-x75x

medium2026-05-04

CVE-2026-41647-Incus has Nil-Pointer Dereference via S3 Bucket Import

lxc/incus · GHSA-fwj8-62r8-8p8m

high2026-05-04

CVE-2026-41326-Kata Container has CopyFile Policy Subversion via Symlinks

kata-containers/kata-containers · GHSA-q49m-57vm-c8cc

critical2026-05-04

CVE-2026-41258-OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange

openmrs/openmrs-core · GHSA-xj4f-8jjg-vx4q

medium2026-05-04

CVE-2026-41181-Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service

traefik/traefik · GHSA-p6hg-qh38-555r

high2026-05-04

CVE-2026-40893-Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move

gotenberg/gotenberg · GHSA-62p3-hvxx-fxg4

high2026-05-04

CVE-2026-40251-Incus Vulnerable to Panic via Snapshot Bounds Check

lxc/incus · GHSA-4m88-wxj4-9qj6

low2026-05-04

CVE-2026-40243-Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots

lxc/incus · GHSA-c839-4qxr-j4x3

critical2026-05-04

CVE-2026-42812-Apache Polaris has an Improper Input Validation issue

apache/polaris · GHSA-w76p-3cgp-qfcm

critical2026-05-04

CVE-2026-42810-Apache Polaris has an Improper Input Validation Issue

apache/polaris · GHSA-vxgg-mqx2-3w59

critical2026-05-04

CVE-2026-42811-Apache Polaris has an Improper Input Validation issue

apache/polaris · GHSA-fc3h-c6h7-r83j

critical2026-05-04

CVE-2026-42027-Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest

apache/opennlp · GHSA-cx4m-2p55-rw7j

critical2026-05-04

CVE-2026-42809-Apache Polaris has an Improper Input Validation Issue

apache/polaris · GHSA-8ggj-j522-h5qf

high2026-05-04

CVE-2026-42440-Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation

apache/opennlp · GHSA-659w-93r5-9j6m

high2026-05-04

CVE-2026-37461-GoBGP has an out-of-bounds read in the ParseIP6Extended function

osrg/gobgp · GHSA-wmvj-f67g-qg4g

critical2026-05-04

CVE-2026-40682-Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing

apache/opennlp · GHSA-4v8g-86x5-3vrc