Security advisories

medium2026-04-25

CVE-2026-42282-n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode

czlonkowski/n8n-mcp · GHSA-wg4g-395p-mqv3

high2026-04-25

CVE-2026-42275-zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

openziti/zrok · GHSA-74m3-9qvm-rp9h

high2026-04-25

CVE-2026-42274-Heimdall has an authorization bypass via path normalization mismatch

dadrus/heimdall · GHSA-3q34-rx83-r6mq

high2026-04-25

CVE-2026-42273-Heimdall: Case-sensitive host matching may lead to policy bypass

dadrus/heimdall · GHSA-72h4-mxfc-jx37

high2026-04-25

CVE-2026-42272-Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

dadrus/heimdall · GHSA-43jv-5j4x-qv67

high2026-04-25

CVE-2026-42271-LiteLLM: Authenticated command execution via MCP stdio test endpoints

berriai/litellm · GHSA-v4p8-mg3p-g94g

medium2026-04-25

CVE-2026-6993-Kratos has a Confused Deputy issue

go-kratos/kratos · GHSA-jj45-xvq5-rhh9

low2026-04-25

CVE-2026-6984-AstrBot has Incomplete Filtering of Special Elements

astrbotdevs/astrbot · GHSA-h3rr-9wqj-v3c6

medium2026-04-25

CVE-2026-6987-PicoClaw has an Injection issue in its Web Launcher Management Plane component

sipeed/picoclaw · GHSA-6r3x-h84w-fhxx

medium2026-04-25

CVE-2026-6982-ShowDoc has an Injection vulnerability

star7th/showdoc · GHSA-fm5r-cj7v-rj2c

high2026-04-25

CVE-2026-6951-simple-git is vulnerable to Remote Code Execution

steveukx/git-js · GHSA-hffm-xvc3-vprc

critical2026-04-24

CVE-2026-41501-electerm has Command Injection via runLinux funtion

electerm/electerm · GHSA-8x35-hph8-37hq

medium2026-04-24

CVE-2026-42150-wlc: print_html outputs API data without HTML escaping

weblateorg/wlc · GHSA-gx2m-mcc2-r4p3

medium2026-04-24

gitverify has improper tag signature verification

supply-chain-tools/gitverify · GHSA-h829-5cg7-6hff

medium2026-04-24

Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

excalidraw/excalidraw · GHSA-39h7-pwv7-rc3x

high2026-04-24

CVE-2026-41485-Kyverno Controller Denial of Service via forEach Mutation Panic

kyverno/kyverno · GHSA-fpjq-c37h-cqcv

high2026-04-24

CVE-2026-41325-Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

getkirby/kirby · GHSA-6gqr-mx34-wh8r

medium2026-04-24

CVE-2026-41263-Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware

traefik/traefik · GHSA-6x2q-h3cr-8j2h

medium2026-04-24

CVE-2026-41174-Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

traefik/traefik · GHSA-xhjw-95fp-8vgq

critical2026-04-24

CVE-2026-12537-Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

google-github-actions/run-gemini-cli · GHSA-wpqr-6v78-jr5g