Security advisories

medium2026-04-15

CVE-2026-5758-Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution

mafintosh/protocol-buffers-schema · GHSA-j452-xhg8-qg39

critical2026-04-15

CVE-2026-6290-Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token

velocidex/velociraptor · GHSA-hv5g-26jg-pc45

critical2026-04-15

CVE-2026-30625-Upsonic: remote code execution vulnerability in its MCP server/task creation functionality

upsonic/upsonic · GHSA-cw73-5f7h-m4gv

medium2026-04-15

CVE-2026-5588-Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

bcgit/bc-java · GHSA-wg6q-6289-32hp

high2026-04-15

CVE-2024-53412-NietThijmen ShoppingCart: Command injection in the connect function

nietthijmen/shoppingcart · GHSA-ggmw-mjhv-75rm

medium2026-04-15

CVE-2026-25219-Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access

apache/airflow · GHSA-4g48-54q2-fg7q

low2026-04-14

Defense in Depth update for NuGet Client

nuget/nuget.client · GHSA-g4vj-cjjj-v7hg

high2026-04-14

CVE-2026-41146-Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem

boazsegev/facil.io · GHSA-2x79-gwq3-vxxm

high2026-04-14

CVE-2026-2332-Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

jetty/jetty.project · GHSA-355h-qmc2-wpwf

high2026-04-14

CVE-2026-41145-MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

minio/minio · GHSA-hv4r-mvr4-25vw

high2026-04-14

CVE-2026-41134-Kiota: Code Generation Literal Injection

microsoft/kiota · GHSA-2hx3-vp6r-mg3f

low2026-04-14

pyLoad's Session Not Invalidated After Permission Changes

pyload/pyload · GHSA-fj52-5g4h-gmq8

high2026-04-14

CVE-2026-41133-pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

pyload/pyload · GHSA-66hx-chf7-3332

medium2026-04-14

CVE-2026-41130-Craft CMS has a host header injection leading to SSRF via resource-js endpoint

craftcms/cms · GHSA-95wr-3f2v-v2wh

medium2026-04-14

CVE-2026-41129-Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations

craftcms/cms · GHSA-3m9m-24vh-39wx

medium2026-04-14

CVE-2026-41128-Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action

craftcms/cms · GHSA-jq2f-59pj-p3m3

low2026-04-14

OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses

opentofu/opentofu · GHSA-hw5x-4r37-72w7

low2026-04-14

DotNetNuke.Core security code analysis rules triggered

dnnsoftware/dnn.platform · GHSA-fcpv-w245-r2q7

medium2026-04-14

CVE-2026-40910-frp has an authentication bypass in HTTP vhost routing when routeByHTTPUser is used for access control

fatedier/frp · GHSA-pq96-pwvg-vrr9

low2026-04-14

ImageMagick has a memory leak in PNG encoder when writing a MNG image

imagemagick/imagemagick · GHSA-x928-4434-crqj