Security advisories

medium2026-04-23

CVE-2026-40894-OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

open-telemetry/opentelemetry-dotnet · GHSA-g94r-2vxg-569j

medium2026-04-23

CVE-2026-40891-OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

open-telemetry/opentelemetry-dotnet · GHSA-mr8r-92fq-pj8p

high2026-04-23

CVE-2026-40886-Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller

argoproj/argo-workflows · GHSA-5jv8-h7qh-rf5p

medium2026-04-23

CVE-2026-40182-OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies

open-telemetry/opentelemetry-dotnet · GHSA-q834-8qmm-v933

medium2026-04-23

CVE-2026-40099-Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter

getkirby/kirby · GHSA-w942-j9r6-hr6r

high2026-04-23

CVE-2026-39973-Apktool: Path Traversal to Arbitrary File Write

ibotpeaches/apktool · GHSA-m8mh-x359-vm8m

high2026-04-23

CVE-2026-34587-Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering

getkirby/kirby · GHSA-jcjw-58rv-c452

high2026-04-23

CVE-2026-33318-Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

actualbudget/actual · GHSA-prp4-2f49-fcgp

medium2026-04-23

CVE-2026-32952-go-ntlmssp NTLM challenges can panic on malformed payloads

azure/go-ntlmssp · GHSA-pjcq-xvwq-hhpj

medium2026-04-23

CVE-2026-32870-Kirby has XML injection in its XML creator toolkit

getkirby/kirby · GHSA-9wfj-c55w-j9qr

critical2026-04-23

CVE-2025-62373-Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer

pipecat-ai/pipecat · GHSA-c2jg-5cp7-6wc7

critical2026-04-23

CVE-2026-39087-ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function

binwiederhier/ntfy · GHSA-pqhx-w72w-m393

critical2026-04-23

CVE-2026-40372-Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege

dotnet/aspnetcore · GHSA-9mv3-2cwr-p262

medium2026-04-23

CVE-2026-41322-Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed

withastro/astro · GHSA-c57f-mm3j-27q9

medium2026-04-23

CVE-2026-41495-n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests

czlonkowski/n8n-mcp · GHSA-pfm2-2mhg-8wpx

medium2026-04-23

CVE-2026-42091-goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

patrickhener/goshs · GHSA-rhf7-wvw3-vjvm

critical2026-04-23

OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool

openc3/cosmos · GHSA-2wvh-87g2-89hr

critical2026-04-23

CVE-2026-42087-OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database

openc3/cosmos · GHSA-v529-vhwc-wfc5

medium2026-04-23

CVE-2026-3960-H2O-3 is Vulnerable to Code Injection

h2oai/h2o-3 · GHSA-qmcv-hh7c-3m56

low2026-04-23

CVE-2026-6878-verl's math_equal() Vulnerable to Arbitrary Code Execution via Unsafe eval()

verl-project/verl · GHSA-h57c-v2v3-5v3v