Security advisories

critical2026-04-15

CVE-2025-41118-Pyroscope Exposes Storage Secret

grafana/pyroscope · GHSA-m9hq-h476-h2g8

medium2026-04-15

CVE-2026-6383-KubeVirt's authorization mechanism improperly truncates subresource names

kubevirt/kubevirt · GHSA-j6cv-3w8p-vrg8

medium2026-04-15

CVE-2026-21726-Grafana Loki Path Traversal - CVE-2021-36156 Bypass

grafana/loki · GHSA-497x-rrr9-68jp

medium2026-04-15

CVE-2026-40486-Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate

kimai/kimai · GHSA-qh43-xrjm-4ggp

medium2026-04-15

CVE-2026-40479-Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget

kimai/kimai · GHSA-g82g-m9vx-vhjg

critical2026-04-15

CVE-2026-40478-Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

thymeleaf/thymeleaf · GHSA-xjw8-8c5c-9r79

critical2026-04-15

CVE-2026-40477-Improper restriction of the scope of accessible objects in Thymeleaf expressions

thymeleaf/thymeleaf · GHSA-r4v4-5mwr-2fwr

medium2026-04-15

CVE-2026-40347-python-multipart affected by Denial of Service via large multipart preamble or epilogue data

kludex/python-multipart · GHSA-mj87-hwqh-73pj

medium2026-04-15

CVE-2026-40346-NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

nocobase/nocobase · GHSA-mvvv-v22x-xqwp

medium2026-04-15

PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket

pmmp/pocketmine-mp · GHSA-xp4f-g2cm-rhg7

medium2026-04-15

CVE-2026-41168-pypdf has long runtimes for wrong size values in cross-reference and object streams

py-pdf/pypdf · GHSA-jj6c-8h6c-hppx

high2026-04-15

CVE-2026-40882-OpenRemote has XXE in Velbus Asset Import

openremote/openremote · GHSA-g24f-mgc3-jwwc

high2026-04-15

CVE-2026-6654-thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

mozilla/thin-vec · GHSA-xphw-cqx3-667j

high2026-04-15

CVE-2026-33806-Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header

fastify/fastify · GHSA-247c-9743-5963

high2026-04-15

CVE-2026-41059-OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex

oauth2-proxy/oauth2-proxy · GHSA-pxq7-h93f-9jrg

medium2026-04-15

CVE-2026-40574-OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims

oauth2-proxy/oauth2-proxy · GHSA-c5c4-8r6x-56w3

critical2026-04-15

CVE-2026-40575-OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing

oauth2-proxy/oauth2-proxy · GHSA-7x63-xv5r-3p2x

medium2026-04-15

CVE-2026-40942-Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache

datasharingframework/dsf · GHSA-xmj9-7625-f634

medium2026-04-15

CVE-2026-40939-Data Sharing Framework is Missing Session Timeout for OIDC Sessions

datasharingframework/dsf · GHSA-gj7p-595x-qwf5

medium2026-04-15

CVE-2026-41161-Sync-in Server has Username Enumeration via Timing Attack

sync-in/server · GHSA-43fj-qp3h-hrh5