Security advisories

critical2026-04-21

CVE-2026-32613-Spinnaker: RCE via expression parsing due to unrestricted context handling

spinnaker/spinnaker · GHSA-69rw-45wj-g4v6

critical2026-04-21

CVE-2026-32604-Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths

spinnaker/spinnaker · GHSA-x3j7-7pgj-h87r

medium2026-04-21

CVE-2026-28684-python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

theskumar/python-dotenv · GHSA-mf9w-mj56-hr94

medium2026-04-21

CVE-2026-25525-OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module

openmage/magento-lts · GHSA-6vqf-6fhm-7rc6

high2026-04-21

CVE-2026-25524-OpenMage LTS: Phar Deserialization leads to Remote Code Execution

openmage/magento-lts · GHSA-fg79-cr9c-7369

medium2026-04-20

CVE-2026-3219-pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

pypa/pip · GHSA-58qw-9mgm-455v

medium2026-04-20

CVE-2026-33558-Apache Kafka exposes sensitive information in its DEBUG logs

apache/kafka · GHSA-wf66-mphr-4c4r

medium2026-04-20

CVE-2025-66335-Apache Doris MCP Server vulnerable to SQL Injection via improper query context neutralization

apache/doris-mcp-server · GHSA-qhfq-gvvc-5q6q

critical2026-04-20

CVE-2026-33557-Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation

apache/kafka · GHSA-28jg-cgg7-j4wc

low2026-04-20

CVE-2026-6634-Memos has an Incorrect Privilege Assignment issue

usememos/memos · GHSA-gqp3-hfc3-8q54

low2026-04-20

CVE-2026-6626-Cockpit has NoSQL Injection Through Content Aggregation Pipelines

cockpit-hq/cockpit · GHSA-5pv2-86qj-5jf9

medium2026-04-20

CVE-2026-6608-FastChat has a Content Moderation Bypass via Arena Side-by-Side Views

lm-sys/fastchat · GHSA-f3q6-69f3-vwch

medium2026-04-20

CVE-2026-6606-AgentScope vulnerable to Server-Side Request Forgery

agentscope-ai/agentscope · GHSA-crx8-wpv6-jrj2

medium2026-04-20

CVE-2026-6607-FastChat has Denial of Service Through Blocking Event Loop in Model Workers (Incomplete Fix for ff66426)

lm-sys/fastchat · GHSA-5h65-jx66-j7p5

low2026-04-20

CVE-2026-6599-Langflow vulnerable to injection

langflow-ai/langflow · GHSA-v66p-f7x3-4794

medium2026-04-20

CVE-2026-6603-AgentScope Vulnerable to Remote Code Injection

agentscope-ai/agentscope · GHSA-cr24-fv3h-8cjm

low2026-04-20

CVE-2026-6598-Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint

langflow-ai/langflow · GHSA-9jpj-cph8-w449

medium2026-04-20

CVE-2026-6605-AgentScope vulnerable to Server-Side Request Forgery

agentscope-ai/agentscope · GHSA-8ggf-r3vm-p3jc

medium2026-04-20

CVE-2026-6604-AgentScope vulnerable to Server-Side Request Forgery

agentscope-ai/agentscope · GHSA-659x-hm75-hpv7

medium2026-04-20

CVE-2026-6596-Langflow: DoS Through Lack of File Size Restriction via Deprecated Unauthenticated File Upload API

langflow-ai/langflow · GHSA-vvfc-fp59-m92g