Security advisories

high2026-05-04

CVE-2026-40563-Apache Atlas has a Code Injection Vulnerability

apache/atlas · GHSA-35xx-9xrg-gwhf

high2026-05-04

CVE-2026-40197-Incus has a Nil-Pointer Dereference via Custom Volume Import

lxc/incus · GHSA-r7w7-mmxr-47r9

high2026-05-04

CVE-2026-40195-Incus has a Nil-Pointer Dereference Panic via Bucket Metadata

lxc/incus · GHSA-gc7j-g665-rxr9

critical2026-05-04

CVE-2026-40076-OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)

openmrs/openmrs-core · GHSA-78fc-9688-w8xw

high2026-05-04

CVE-2026-39852-Quarkus has Authentication/Authorization bypasses

quarkusio/quarkus · GHSA-rc95-pcm8-65v9

high2026-05-04

CVE-2026-40075-OpenMRS ModuleResourcesServlet has Path Traversal that Leads to Arbitrary File Read

openmrs/openmrs-core · GHSA-jjgj-cx3q-pw4w

medium2026-05-04

CVE-2026-35527-Incus has Blind SSRF via Image Import Preflight HEAD

lxc/incus · GHSA-8gw4-p4wq-4hcv

low2026-05-04

CVE-2026-41358-OpenClaw: Slack thread context could include messages from non-allowlisted senders

openclaw/openclaw · GHSA-qm77-8qjp-4vcm

critical2026-05-04

CVE-2026-24118-VM2 Sandbox Breakout Through __lookupGetter__

patriksimek/vm2 · GHSA-grj5-jjm8-h35p

high2026-05-04

CVE-2026-7482-Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader

ollama/ollama · GHSA-x8qc-fggm-mpqg

medium2026-05-04

CVE-2026-7737-GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer

osrg/gobgp · GHSA-w88c-9vg8-cmq8

medium2026-05-04

CVE-2026-7736-GoBGP has an Integer Underflow Issue

osrg/gobgp · GHSA-hj4w-qr9j-c4cf

low2026-05-04

CVE-2026-7738-@puchunjie/doc-tools-mcp has a Path Traversal Issue

puchunjie/doc-tools-mcp · GHSA-gcmm-c94j-j47x

high2026-05-04

CVE-2026-29199-phpBB has Password Reset Link Poisoning via Host Header injection

phpbb/phpbb-app · GHSA-7gm6-w7mx-58cr

medium2026-05-04

CVE-2026-7734-GoBGP has an Improper Resource Shutdown or Release

osrg/gobgp · GHSA-vm3g-8xwv-mxfp

low2026-05-04

CVE-2026-7725-Prefect Git Argument Injection in GitRepository Pull Steps

prefecthq/prefect · GHSA-6rcx-55r6-jx65

low2026-05-04

CVE-2026-7724-Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url

prefecthq/prefect · GHSA-p3pq-hxmr-vqqr

medium2026-05-04

CVE-2026-7723-Prefect Unauthenticated Event Injection via /api/events/in WebSocket

prefecthq/prefect · GHSA-hvph-5985-r63v

medium2026-05-04

CVE-2026-7722-Prefect Auth Bypass via endswith() Health Check Exemption

prefecthq/prefect · GHSA-6rr6-v7cj-mxpg

medium2026-05-04

CVE-2026-7711-MindsDB has an Improper Access Control Issue

mindsdb/mindsdb · GHSA-9f6m-65v9-x9g2