Security advisories

medium2026-04-22

CVE-2026-41238-DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

cure53/dompurify · GHSA-v9jr-rg53-9pgp

critical2026-04-22

CVE-2026-41203-CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE

ci4-cms-erp/ci4ms · GHSA-xv3r-vr59-95rg

critical2026-04-22

CVE-2026-41202-CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE

ci4-cms-erp/ci4ms · GHSA-xp9f-pvvc-57p4

medium2026-04-22

CVE-2026-41201-CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS

ci4-cms-erp/ci4ms · GHSA-qxpq-82f3-xj47

high2026-04-22

CVE-2026-6859-InstructLab Includes Functionality from Untrusted Control Sphere

instructlab/instructlab · GHSA-rxpq-xgqx-fr7p

high2026-04-22

CVE-2026-6857-camel-infinispan Vulnerable to Deserialization of Untrusted Data

apache/camel · GHSA-xfxp-ppx7-cqrp

high2026-04-22

CVE-2026-6855-InstructLab vulnerable to Path Traversal

instructlab/instructlab · GHSA-pqmg-c2j8-fq92

high2026-04-22

PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes

sebastianbergmann/phpunit · GHSA-mh6w-vxff-9wqp

high2026-04-22

engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection

nickcirv/engram · GHSA-2r2p-4cgf-hv7h

critical2026-04-22

CVE-2026-41179-RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

rclone/rclone · GHSA-jfwf-28xr-xw6q

critical2026-04-22

CVE-2026-41176-Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

rclone/rclone · GHSA-25qr-6mpr-f7qx

high2026-04-22

CVE-2026-41166-OpenRemote has Improper Access Control via updateUserRealmRoles function

openremote/openremote · GHSA-49vv-25qx-mg44

medium2026-04-22

actix-http has HTTP/1.1 CL.TE Request Smuggling

actix/actix-web · GHSA-xhj4-vrgc-hr34

low2026-04-22

CVE-2026-41140-Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

python-poetry/poetry · GHSA-73h3-mf4w-8647

high2026-04-22

@saltcorn/data: Tenant user role is used for tenant creation role check

saltcorn/saltcorn · GHSA-9237-rg5p-rhfw

critical2026-04-22

CVE-2026-41070-openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access

jkroepke/openvpn-auth-oauth2 · GHSA-246w-jgmq-88fg

high2026-04-22

CVE-2026-40542-Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification

apache/httpcomponents-client · GHSA-v468-qcjx-r72w

medium2026-04-22

CVE-2026-22748-Spring Security has Potential Security Misconfiguration when Using withIssuerLocation

spring-projects/spring-security · GHSA-cvc6-q2cp-2xhw

high2026-04-22

CVE-2026-22753-Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers

spring-projects/spring-security · GHSA-4wrg-8wpc-h923

high2026-04-22

CVE-2026-22754-Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules

spring-projects/spring-security · GHSA-4vrc-j85c-598c