Security advisories

medium2026-04-24

CVE-2026-42199-Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

becheran/grid · GHSA-38c5-483c-4qqp

high2026-04-24

CVE-2026-41432-New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

quantumnous/new-api · GHSA-xff3-5c9p-2mr4

critical2026-04-24

CVE-2026-41328-Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

dgraph-io/dgraph · GHSA-x92x-px7w-4gx4

critical2026-04-24

CVE-2026-41327-Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

dgraph-io/dgraph · GHSA-mrxx-39g5-ph77

high2026-04-24

CVE-2026-42189-russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler

eugeny/russh · GHSA-f5v4-2wr6-hqmg

medium2026-04-24

CVE-2026-42190-RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions

redwoodjs/sdk · GHSA-m2m6-cff5-3w7c

high2026-04-24

CVE-2026-41316-ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

ruby/erb · GHSA-q339-8rmv-2mhv

high2026-04-24

CVE-2026-41311-liquidjs has a Denial of Service via circular block reference in layout

harttle/liquidjs · GHSA-4rc3-7j7w-m548

medium2026-04-24

CVE-2026-40690-Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions

apache/airflow · GHSA-w7rc-q6cm-f5gm

medium2026-04-24

CVE-2026-38743-Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record

apache/airflow · GHSA-p3v3-229h-mc63

medium2026-04-24

CVE-2026-41305-PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

postcss/postcss · GHSA-qx2v-qp2m-jg93

medium2026-04-24

CVE-2026-42180-Lemmy has SSRF in /api/v3/post via Webmention dispatch

lemmynet/lemmy · GHSA-3jvj-v6w2-h948

medium2026-04-24

CVE-2026-42181-Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image

lemmynet/lemmy · GHSA-h6hf-9846-xwrq

high2026-04-24

CVE-2026-41246-Contour has Lua code injection via Cookie Path Rewrite Policy

projectcontour/contour · GHSA-x4mj-7f9g-29h4

high2026-04-24

CVE-2026-40466-Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection

apache/activemq · GHSA-w3w2-mpp5-92gm

high2026-04-24

CVE-2026-41044-Apache ActiveMQ Vulnerable to Code Injection

apache/activemq · GHSA-mr6m-xj7v-3cv3

medium2026-04-24

CVE-2025-62233-Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability

apache/dolphinscheduler · GHSA-f786-9c63-8xr8

high2026-04-24

CVE-2026-23902-Apache DolphinScheduler has an Incorrect Authorization Vulnerability

apache/dolphinscheduler · GHSA-72mv-wwvm-vgp5

medium2026-04-24

CVE-2026-41043-Apache ActiveMQ Vulnerable to Cross-site Scripting

apache/activemq · GHSA-2jp3-2923-9h52

high2026-04-24

CVE-2026-21728-Grafana Tempo has an Uncontrolled Resource Consumption issue

grafana/tempo · GHSA-p4r4-xvrq-gvmc