Security advisories

medium2026-04-24

CVE-2026-42241-ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width

g-research/parquetsharp · GHSA-rrjr-v56m-ww88

high2026-04-24

CVE-2026-6553-TYPO3 CMS Stores Cleartext Password in User Settings Module

typo3/typo3 · GHSA-xvv6-p4wf-mvx7

high2026-04-24

CVE-2026-40912-Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync

traefik/traefik · GHSA-6jwx-7vp4-9847

high2026-04-24

k8sGPT has Prompt Injection through its k8sGPT-Operator

k8sgpt-ai/k8sgpt · GHSA-rp7v-4384-hfrp

high2026-04-24

CVE-2026-40068-Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution

anthropics/claude-code · GHSA-q5hj-mxqh-vv77

high2026-04-24

CVE-2026-39858-Traefik: Pre-authentication decision bypass due to forwarded alias spoofing

traefik/traefik · GHSA-5m6w-wvh7-57vm

high2026-04-24

CVE-2026-35051-Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication

traefik/traefik · GHSA-6384-m2mw-rf54

critical2026-04-24

go-zserio has Unbounded Memory Allocation for All Platforms

woven-by-toyota/go-zserio · GHSA-xhj4-g6w8-2xjw

high2026-04-24

CVE-2026-33524-Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

ndsev/zserio · GHSA-cwq5-8pvq-j65j

high2026-04-24

rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

rustls/webpki · GHSA-82j2-j2ch-gfr8

high2026-04-24

CVE-2026-42239-Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover

budibase/budibase · GHSA-4f9j-vr4p-642r

low2026-04-24

CVE-2026-41498-Kimai has Missing Object-Level Authorization in the Team API

kimai/kimai · GHSA-jv9x-w4gm-hwcm

critical2026-04-24

CVE-2026-42208-LiteLLM has SQL Injection in Proxy API key verification

berriai/litellm · GHSA-r75f-5x8p-qvmc

critical2026-04-24

CVE-2026-41492-Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars

dgraph-io/dgraph · GHSA-vvf7-6rmr-m29q

high2026-04-24

CVE-2026-41486-Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization

ray-project/ray · GHSA-mw35-8rx3-xf9r

high2026-04-24

CVE-2026-42205-Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

avo-hq/avo · GHSA-qc5p-3mg5-9fh8

high2026-04-24

CVE-2026-42203-LiteLLM: Server-Side Template Injection in /prompts/test endpoint

berriai/litellm · GHSA-xqmj-j6mv-4862

medium2026-04-24

CVE-2026-42202-nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

almirhodzic/nova-toggle-5 · GHSA-f5c8-m5vw-rmgq

medium2026-04-24

CVE-2026-6550-AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache

aws/aws-encryption-sdk-python · GHSA-v638-38fc-rhfv

medium2026-04-24

CVE-2026-42199-Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

becheran/grid · GHSA-38c5-483c-4qqp