Security advisories

high2026-04-16

CVE-2026-40308-Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar

joedolson/my-calendar · GHSA-2mvx-f5qm-v2ch

high2026-04-16

CVE-2026-41883-OmniFaces: EL injection via crafted resource name in wildcard CDN mapping

omnifaces/omnifaces · GHSA-vp6r-9m58-5xv8

medium2026-04-16

CVE-2026-41314-pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

py-pdf/pypdf · GHSA-x284-j5p8-9c5p

medium2026-04-16

CVE-2026-41313-pypdf: Possible long runtimes for wrong size values in incremental mode

py-pdf/pypdf · GHSA-4pxv-j86v-mhcw

medium2026-04-16

CVE-2026-41312-pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

py-pdf/pypdf · GHSA-7gw9-cf7v-778f

high2026-04-16

CVE-2026-40611-ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

go-acme/lego · GHSA-qqx8-2xmm-jrv8

medium2026-04-16

CVE-2026-40602-Home Assistant Command-line Interface: Handling of user-supplied Jinja2 templates

home-assistant-ecosystem/home-assistant-cli · GHSA-33qf-q99x-wpm8

critical2026-04-16

CVE-2026-41248-Official Clerk JavaScript SDKs: Middleware-based route protection bypass

clerk/javascript · GHSA-vqx2-fgx2-5wq9

high2026-04-16

CVE-2026-41175-Statamic: Unsafe method invocation via query value resolution allows data destruction

statamic/cms · GHSA-4jjr-vmv7-wh4w

high2026-04-16

CVE-2026-41304-WWBN AVideo: RCE cause by clonesite plugin

wwbn/avideo · GHSA-xr6f-h4x7-r6qp

critical2026-04-16

CVE-2026-41500-electerm: electerm_install_script_CommandInjection Vulnerability Report

electerm/electerm · GHSA-wxw2-rwmh-vr8f

medium2026-04-16

CVE-2026-56275-Flowise Execute Flow function has an SSRF vulnerability

flowiseai/flowise · GHSA-9hrv-gvrv-6gf2

medium2026-04-16

CVE-2026-43995-Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

flowiseai/flowise · GHSA-qqvm-66q4-vf5c

medium2026-04-16

Flowise: Path Traversal in Vector Store basePath

flowiseai/flowise · GHSA-w6v6-49gh-mc9w

medium2026-04-16

CVE-2026-56269-Flowise: Weak Default Token Hash Secret

flowiseai/flowise · GHSA-m7mq-85xj-9x33

medium2026-04-16

Flowise: Weak Default Express Session Secret

flowiseai/flowise · GHSA-2qqc-p94c-hxwh

medium2026-04-16

Flowise: Weak Default JWT Secrets

flowiseai/flowise · GHSA-cc4f-hjpj-g9p8

medium2026-04-16

CVE-2026-56270-Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request

flowiseai/flowise · GHSA-6pcv-j4jx-m4vx

low2026-04-16

CVE-2026-43529-OpenClaw: TOCTOU read in exec script preflight

openclaw/openclaw · GHSA-gj9q-8w99-mp8j

critical2026-04-16

CVE-2026-40933-Flowise: Authenticated RCE Via MCP Adapters

flowiseai/flowise · GHSA-c9gw-hvqq-f33r