Security advisories

high2026-04-18

CVE-2026-41570-PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes

sebastianbergmann/phpunit · GHSA-qrr6-mg7r-m243

low2026-04-18

Zio has SubFileSystem Path Confinement Bypass via Unresolved `..` Segment

xoofx/zio · GHSA-h39g-6x3c-7fq9

critical2026-04-18

CVE-2026-41265-Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

flowiseai/flowise · GHSA-v38x-c887-992f

medium2026-04-18

CVE-2026-40881-Zebra: addr/addrv2 Deserialization Resource Exhaustion

zcashfoundation/zebra · GHSA-xr93-pcq3-pxf8

high2026-04-18

CVE-2026-40880-Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks

zcashfoundation/zebra · GHSA-xvj8-ph7x-65gf

high2026-04-17

CVE-2026-41247-elFinder: Command injection in resize background color parameter when using ImageMagick CLI

studio-42/elfinder · GHSA-8q4h-8crm-5cvc

medium2026-04-17

OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths

openclaw/openclaw · GHSA-f934-5rqf-xx47

medium2026-04-17

CVE-2026-41389-OpenClaw: Webchat media embedding enforces local-root containment for tool-result files

openclaw/openclaw · GHSA-mr34-9552-qr95

critical2026-04-17

CVE-2026-44109-OpenClaw: Feishu webhook and card-action validation now fail closed

openclaw/openclaw · GHSA-xh72-v6v9-mwhc

high2026-04-17

CVE-2026-44110-OpenClaw: Matrix room control-command authorization no longer trusts DM pairing-store entries

openclaw/openclaw · GHSA-2gvc-4f3c-2855

critical2026-04-17

CVE-2026-43585-OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation

openclaw/openclaw · GHSA-xmxx-7p24-h892

critical2026-04-17

CVE-2026-41507-Remote Code Execution (RCE) via String Literal Injection into math-codegen

mauriciopoppe/math-codegen · GHSA-p6x5-p4xf-cc4r

medium2026-04-17

CVE-2026-41506-go-git: Credential leak via cross-host redirect in smart HTTP transport

go-git/go-git · GHSA-3xc5-wrhm-f963

low2026-04-17

Kimai: Username enumeration via timing on X-AUTH-USER

kimai/kimai · GHSA-jrc6-fmhw-fpq2

high2026-04-17

CVE-2026-41496-PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

mervinpraison/praisonai · GHSA-rg3h-x3jw-7jm5

critical2026-04-17

CVE-2026-41497-PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection

mervinpraison/praisonai · GHSA-9qhq-v63v-fv3j

high2026-04-17

CVE-2026-41433-OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR

open-telemetry/opentelemetry-ebpf-instrumentation · GHSA-8gmg-3w2q-65f4

medium2026-04-17

CVE-2026-41493-yard: Possible arbitrary path traversal and file access via yard server

lsegal/yard · GHSA-3jfp-46x4-xgfj

high2026-04-17

CVE-2026-41491-Dapr: Service Invocation path traversal ACL bypass

dapr/dapr · GHSA-85gx-3qv6-4463

medium2026-04-17

CVE-2026-35603-Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

anthropics/claude-code · GHSA-5cwg-9f6j-9jvx