Security advisories

low2026-04-23

CVE-2026-29051-melange has Path Traversal via .PKGINFO in --persist-lint-results

chainguard-dev/melange · GHSA-q2pw-xx38-p64j

medium2026-04-23

CVE-2026-29050-melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses

chainguard-dev/melange · GHSA-98f2-w9h9-7fp9

low2026-04-23

CVE-2026-41321-Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)

withastro/astro · GHSA-88gm-j2wx-58h6

high2026-04-23

CVE-2026-41900-OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

th30d4y/openlearnx · GHSA-8h25-q488-4hxw

medium2026-04-23

CVE-2026-41173-OpenTelemetry.Sampler.AWS & OpenTelemetry.Resources.AWS have unbounded HTTP response body reads

open-telemetry/opentelemetry-dotnet-contrib · GHSA-28xm-prxc-5866

medium2026-04-23

CVE-2026-40894-OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

open-telemetry/opentelemetry-dotnet · GHSA-g94r-2vxg-569j

medium2026-04-23

CVE-2026-40891-OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

open-telemetry/opentelemetry-dotnet · GHSA-mr8r-92fq-pj8p

high2026-04-23

CVE-2026-40886-Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

argoproj/argo-workflows · GHSA-5jv8-h7qh-rf5p

medium2026-04-23

CVE-2026-40182-OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies

open-telemetry/opentelemetry-dotnet · GHSA-q834-8qmm-v933

medium2026-04-23

CVE-2026-40099-Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter

getkirby/kirby · GHSA-w942-j9r6-hr6r

high2026-04-23

CVE-2026-39973-Apktool: Path Traversal to Arbitrary File Write

ibotpeaches/apktool · GHSA-m8mh-x359-vm8m

high2026-04-23

CVE-2026-34587-Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering

getkirby/kirby · GHSA-jcjw-58rv-c452

high2026-04-23

CVE-2026-33318-Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

actualbudget/actual · GHSA-prp4-2f49-fcgp

medium2026-04-23

CVE-2026-32952-go-ntlmssp NTLM challenges can panic on malformed payloads

azure/go-ntlmssp · GHSA-pjcq-xvwq-hhpj

medium2026-04-23

CVE-2026-32870-Kirby has XML injection in its XML creator toolkit

getkirby/kirby · GHSA-9wfj-c55w-j9qr

critical2026-04-23

CVE-2025-62373-Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer

pipecat-ai/pipecat · GHSA-c2jg-5cp7-6wc7

critical2026-04-23

CVE-2026-39087-ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function

binwiederhier/ntfy · GHSA-pqhx-w72w-m393

critical2026-04-23

CVE-2026-40372-Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege

dotnet/aspnetcore · GHSA-9mv3-2cwr-p262

medium2026-04-23

CVE-2026-41322-Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed

withastro/astro · GHSA-c57f-mm3j-27q9

medium2026-04-23

CVE-2026-41495-n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests

czlonkowski/n8n-mcp · GHSA-pfm2-2mhg-8wpx