Security advisories

critical2026-04-30

CVE-2026-42560-auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

go-pkgz/auth · GHSA-f6qq-3m3h-4g42

critical2026-04-30

CVE-2026-42354-Sentry's improper authentication on SAML SSO process allows user identity linking

getsentry/sentry · GHSA-rcmw-7mc7-3rj7

medium2026-04-30

CVE-2026-42191-OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter

open-telemetry/opentelemetry-dotnet · GHSA-4625-4j76-fww9

medium2026-04-30

CVE-2026-36766-Shopizer is vulnerable to Cross-site Scripting

shopizer-ecommerce/shopizer · GHSA-fqcw-2xhj-p63g

critical2026-04-30

CVE-2026-36767-Shopizer has a path traversal issue

shopizer-ecommerce/shopizer · GHSA-f5w4-7ccj-5m75

high2026-04-30

CVE-2026-36340-Krayin CRM allows a remote attacker to execute arbitrary code via compose email function

krayin/laravel-crm · GHSA-32px-ccfx-cxq3

low2026-04-30

ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction

ydb-platform/ydb-go-sdk · GHSA-28xx-pppm-vqff

high2026-04-30

CVE-2026-42349-Clerk has an authorization bypass when combining organization, billing, or reverification checks

clerk/javascript · GHSA-w24r-5266-9c3c

high2026-04-30

CVE-2026-42449-n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders

czlonkowski/n8n-mcp · GHSA-56c3-vfp2-5qqj

high2026-04-30

Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation

hickory-dns/hickory-dns · GHSA-83hf-93m4-rgwq

medium2026-04-30

CVE-2026-42032-CKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`

ckan/ckan · GHSA-cg4x-64p3-x59h

medium2026-04-30

CVE-2026-41654-Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

weblateorg/weblate · GHSA-cwcx-382v-8m9g

medium2026-04-30

CVE-2026-41519-Weblate Doesn't Invalidate API Token on Password Change

weblateorg/weblate · GHSA-6j8j-4qp3-36p2

critical2026-04-30

CVE-2026-40281-Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)

gotenberg/gotenberg · GHSA-q7r4-hc83-hf2q

high2026-04-30

CVE-2026-40171-Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

jupyter/notebook · GHSA-rch3-82jr-f9w9

medium2026-04-30

CVE-2026-39383-Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL

gotenberg/gotenberg · GHSA-5vh4-rgv7-p9g4

high2026-04-30

CVE-2026-40280-Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection

gotenberg/gotenberg · GHSA-5q7p-7jgv-ww56

medium2026-04-30

CVE-2026-7500-Keycloak has a Forced Browsing issue

keycloak/keycloak · GHSA-hm32-hfmw-rhvg

medium2026-04-30

CVE-2026-41016-apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider

apache/airflow · GHSA-x8mh-94wc-33gv

low2026-04-30

CVE-2025-13030-django-mdeditor is Missing Authentication for Critical Function

pylixm/django-mdeditor · GHSA-qp2c-xqv6-phh6