Security advisories

high2026-04-29

CVE-2026-41643-GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE

osrg/gobgp · GHSA-8rxh-r2p6-7f2q

high2026-04-29

CVE-2026-41642-GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path Attribute

osrg/gobgp · GHSA-7235-89m6-f4px

high2026-04-29

CVE-2026-41587-CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution

ci4-cms-erp/ci4ms · GHSA-fw49-9xq4-gmx6

critical2026-04-29

CVE-2026-41586-fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE

hyperledger/fabric-sdk-java · GHSA-prf8-cf2x-rhx7

medium2026-04-29

CVE-2026-41255-CKAN has CSRF exemption primed by anonymous requests

ckan/ckan · GHSA-mcvf-jxcw-vj73

medium2026-04-29

CVE-2026-41132-CKAN has no certificate validation on STMP connection

ckan/ckan · GHSA-mpfm-fpgx-647q

high2026-04-29

CVE-2026-40902-PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

phpoffice/phpspreadsheet · GHSA-7c6m-4442-2x6m

high2026-04-29

CVE-2026-40863-PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

phpoffice/phpspreadsheet · GHSA-84wq-86v6-x5j6

critical2026-04-29

CVE-2026-34084-PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled

phpoffice/phpspreadsheet · GHSA-q4q6-r8wh-5cgh

medium2026-04-29

CVE-2026-41484-OneCollector exporter reads unbounded HTTP response bodies

open-telemetry/opentelemetry-dotnet-contrib · GHSA-55m9-299j-53c7

medium2026-04-29

CVE-2026-38993-Cockpit is vulnerable to directory traversal

cockpit-hq/cockpit · GHSA-p46p-7pmj-m34f

high2026-04-29

CVE-2026-38991-Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type

cockpit-hq/cockpit · GHSA-j2rx-4jg9-79mw

medium2026-04-29

CVE-2026-41483-OpenTelemetry.Resources.Azure has an unbounded HTTP response body read

open-telemetry/opentelemetry-dotnet-contrib · GHSA-vc24-j8c5-2vw4

medium2026-04-29

CVE-2026-42052-beets has a Cross-site Scripting vulnerability

beetbox/beets · GHSA-3gxm-wfjx-m847

medium2026-04-29

CVE-2026-42525-Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability

jenkinsci/azure-ad-plugin · GHSA-jp6g-g3v3-6gvf

critical2026-04-29

CVE-2026-38992-Cockpit is vulnerable to arbitrary code execution

cockpit-hq/cockpit · GHSA-fm6c-rhcf-7439

high2026-04-29

CVE-2026-42524-Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file

jenkinsci/htmlpublisher-plugin · GHSA-f8h4-46xv-h7jj

critical2026-04-29

CVE-2026-42523-Jenkins GitHub Plugin has an XSS vulnerability

jenkinsci/github-plugin · GHSA-w22p-4x9f-486v

medium2026-04-29

CVE-2026-42519-Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths

jenkinsci/script-security-plugin · GHSA-p334-gfhq-c7w6

high2026-04-29

CVE-2026-42520-Jenkins Credentials Binding Plugin has a path traversal vulnerability

jenkinsci/credentials-binding-plugin · GHSA-p2rf-wpxj-mx2g