Security advisories

high2026-04-16

CVE-2026-34393-Weblate: Privilege escalation in the user API endpoint

weblateorg/weblate · GHSA-3382-gw9x-477v

medium2026-04-16

CVE-2026-34244-Weblate: SSRF via Project-Level Machinery Configuration

weblateorg/weblate · GHSA-xrwr-fcw6-fmq8

high2026-04-16

CVE-2026-34242-Weblate: Arbitrary File Read via Symlink

weblateorg/weblate · GHSA-hv99-mxm5-q397

medium2026-04-16

CVE-2026-34164-Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService

valtimo-platform/valtimo · GHSA-hfrg-mcvw-8mch

medium2026-04-16

CVE-2026-33889-ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context

apostrophecms/apostrophe · GHSA-97v6-998m-fp4g

medium2026-04-16

CVE-2026-33888-ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API

apostrophecms/apostrophe · GHSA-xhq9-58fw-859p

low2026-04-16

CVE-2026-33877-ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint

apostrophecms/apostrophe · GHSA-mj7r-x3h3-7rmr

medium2026-04-16

CVE-2026-33440-Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

weblateorg/weblate · GHSA-5fhx-9jwj-867m

high2026-04-16

CVE-2026-33435-Weblate: Remote code execution during backup restoration

weblateorg/weblate · GHSA-558g-h753-6m33

medium2026-04-16

CVE-2026-33220-Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository

weblateorg/weblate · GHSA-mqph-7h49-hqfm

medium2026-04-16

CVE-2026-33214-Weblate: Improper access control for the translation memory in API

weblateorg/weblate · GHSA-mpf5-3vph-q75r

low2026-04-16

CVE-2026-33212-Weblate: Improper access control for pending tasks in API

weblateorg/weblate · GHSA-vj45-x3pj-f4w4

medium2026-04-16

CVE-2026-27820-Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

ruby/zlib · GHSA-g857-hhfv-j68w

medium2026-04-16

CVE-2026-24749-Silverstripe Assets Module has a DBFile::getURL() permission bypass

silverstripe/silverstripe-assets · GHSA-jgcf-rf45-2f8v

medium2026-04-16

CVE-2026-31987-Apache Airflow: JWT token appearing in logs

apache/airflow · GHSA-phv5-vq5p-qhp7

critical2026-04-16

CVE-2026-31843-goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files

shaxzodbek-uzb/pay-uz · GHSA-m5wg-cjgh-223j

high2026-04-16

CVE-2026-30778-SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information

apache/skywalking · GHSA-27h3-crw2-q36w

medium2026-04-16

CVE-2026-40353-wger has Stored XSS via Unescaped License Attribution Fields

wger-project/wger · GHSA-6f54-qjvm-wwq3

high2026-04-16

CVE-2026-40474-wger has Broken Access Control in Global Gym Configuration Update Endpoint

wger-project/wger · GHSA-xppv-4jrx-qf8m

medium2026-04-16

Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance

renovatebot/renovate · GHSA-5vjq-5jmg-39xq