Security advisories

low2026-04-28

CVE-2026-40969-Spring gRPC AuthenticationException messages are reflected to remote client

spring-projects/spring-grpc · GHSA-37w2-q6vh-45v6

high2026-04-28

CVE-2026-41602-Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability

apache/thrift · GHSA-wf45-q9ch-q8gh

high2026-04-28

CVE-2026-41636-Apache Thrift Node.js bindings vulnerable to Uncontrolled Recursion

apache/thrift · GHSA-r67j-r569-jrwp

high2026-04-28

CVE-2026-41603-Apache Thrift has an issue with Java TSSLTransportFactory hostname verification

apache/thrift · GHSA-gf47-qgg5-9g9q

medium2026-04-28

CVE-2026-40966-Spring AI's VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

spring-projects/spring-ai · GHSA-v6x6-pjxw-3pv2

medium2026-04-28

CVE-2026-40979-Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory

spring-projects/spring-ai · GHSA-r5hp-3cgj-j6xv

high2026-04-28

CVE-2026-40978-Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()

spring-projects/spring-ai · GHSA-63c8-m9m2-cvr3

medium2026-04-28

CVE-2026-40980-Spring AI Vulnerable to OOM by attacker-controlled PDF

spring-projects/spring-ai · GHSA-26gg-9gv2-v27j

high2026-04-28

CVE-2026-40967-Spring AI has a VectorStore FilterExpression Converter injection

spring-projects/spring-ai · GHSA-qc4j-qjqx-vr58

medium2026-04-28

CVE-2026-42510-OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

openstack/ironic · GHSA-wqpv-c3pp-3m58

medium2026-04-28

CVE-2026-7223-BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue

bigsweetpotatostudio/hyperchat · GHSA-r2jq-4h3x-rfj6

medium2026-04-28

CVE-2026-7212-notes-mcp has a Path Traversal issue

edvardlindelof/notes-mcp · GHSA-vc5j-42hh-j3mr

medium2026-04-28

CVE-2026-7206-sqlite-mcp has an Injection issue

dubydu/sqlite-mcp · GHSA-4j28-22qp-rjcf

high2026-04-28

CVE-2026-40973-Spring Boot accepts predictable temp directory without ownership verification

spring-projects/spring-boot · GHSA-wwpq-f5c3-7hvx

medium2026-04-28

CVE-2026-40974-Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

spring-projects/spring-boot · GHSA-mqvw-jfmh-93qq

medium2026-04-28

CVE-2026-40975-Spring Boot's random value property source uses a weak PRNG unsuitable for secrets

spring-projects/spring-boot · GHSA-m4x9-hx6x-2c43

critical2026-04-28

CVE-2026-40976-Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

spring-projects/spring-boot · GHSA-8v8j-3hxp-93wr

medium2026-04-28

CVE-2026-40977-Spring Boot's PID file write follows symlinks at predictable default path

spring-projects/spring-boot · GHSA-5368-6h4h-gr29

medium2026-04-28

CVE-2026-7159-mkdocs-mcp-plugin has a Path Traversal issue

douinc/mkdocs-mcp-plugin · GHSA-wfr3-hf93-qgg3

medium2026-04-28

CVE-2026-40971-Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker

spring-projects/spring-boot · GHSA-9vc8-qppq-wvxc