Security advisories

low2026-04-20

CVE-2026-6597-Langflow has an Information Leak through Incomplete API Key Redaction

langflow-ai/langflow · GHSA-5jjf-wcvf-923w

medium2026-04-20

CVE-2026-6594-Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization

brikcss/merge · GHSA-3jc6-6r48-v6qf

low2026-04-20

CVE-2026-6587-RAGAS has SSRF via Multi-Modal Faithfulness Collections Module

vibrantlabsai/ragas · GHSA-95ww-475f-pr4f

medium2026-04-18

CVE-2026-40948-apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation

apache/airflow · GHSA-5w6h-pjw6-wvc6

low2026-04-18

CVE-2026-32690-Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries

apache/airflow · GHSA-w9r4-94fj-xp69

medium2026-04-18

CVE-2026-30912-Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false

apache/airflow · GHSA-w7cf-2pmc-5m4c

high2026-04-18

CVE-2026-32228-Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions

apache/airflow · GHSA-h97w-pm3w-mwmc

high2026-04-18

CVE-2026-25917-Apache Airflow allows code execution through crafted XCom payloads

apache/airflow · GHSA-6ffj-2wg2-w45j

critical2026-04-18

CVE-2026-41583-Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling

zcashfoundation/zebra · GHSA-8m29-fpq5-89jj

medium2026-04-18

CVE-2026-41585-Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients

zcashfoundation/zebra · GHSA-29x4-r6jv-ff4w

critical2026-04-18

CVE-2026-41584-Zebra has rk Identity Point Panic in Transaction Verification

zcashfoundation/zebra · GHSA-452v-w3gx-72wg

medium2026-04-18

CVE-2026-41319-MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

jstedfast/mailkit · GHSA-9j88-vvj5-vhgr

high2026-04-18

CVE-2026-41241-pretalx vulnerable to stored cross-site scripting in organizer search typeahead

pretalx/pretalx · GHSA-cjcx-jfp2-f7m2

medium2026-04-18

CVE-2026-41426-pretalx mail templates vulnerable to email injection via unescaped user-controlled placeholders

pretalx/pretalx · GHSA-jm8c-9f3j-4378

critical2026-04-18

CVE-2026-41589-Wish has SCP Path Traversal that allows arbitrary file read/write

charmbracelet/wish · GHSA-xjvp-7243-rg9h

high2026-04-18

CVE-2026-41490-Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

dagster-io/dagster · GHSA-mjw2-v2hm-wj34

medium2026-04-18

CVE-2026-6437-Amazon EFS CSI Driver has mount option injection via unsanitized volumeHandle and mounttargetip fields

kubernetes-sigs/aws-efs-csi-driver · GHSA-mph4-q2vm-w2pw

medium2026-04-18

CVE-2026-41078-OpenTelemetry .NET has potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path

open-telemetry/opentelemetry-dotnet · GHSA-38h3-2333-qx47

high2026-04-18

CVE-2026-41143-YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()

yeswiki/yeswiki · GHSA-f58v-p6j9-24c2

critical2026-04-18

CVE-2026-41574-Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass

nhost/nhost · GHSA-6g38-8j4p-j3pr