Security advisories

medium2026-04-14

CVE-2026-40105-XWiki has Reflected Cross-Site Scripting (XSS) in page history compare

xwiki/xwiki-platform · GHSA-w4fj-87j5-f25c

medium2026-04-14

CVE-2026-40091-SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs

authzed/spicedb · GHSA-jf4f-rr2c-9m58

high2026-04-14

CVE-2026-40090-Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

zarf-dev/zarf · GHSA-pj97-4p9w-gx3q

high2026-04-14

CVE-2026-39971-Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header

s9y/serendipity · GHSA-458g-q4fh-mj6r

medium2026-04-14

CVE-2026-39963-Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php

s9y/serendipity · GHSA-4m6c-649p-f6gf

high2026-04-14

CVE-2026-39884-MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting

flux159/mcp-server-kubernetes · GHSA-4xqg-gf5c-ghwq

critical2026-04-14

CVE-2026-39842-Expression Injection in OpenRemote

openremote/openremote · GHSA-7mqr-33rv-p3mp

critical2026-04-14

CVE-2026-34457- OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode

oauth2-proxy/oauth2-proxy · GHSA-5hvv-m4w4-gf6v

low2026-04-14

CVE-2026-34454-OAuth2 Proxy's session cookies are not cleared when rendering sign-in page

oauth2-proxy/oauth2-proxy · GHSA-f24x-5g9q-753f

medium2026-04-14

CVE-2026-33414-PowerShell Command Injection in Podman HyperV Machine

containers/podman · GHSA-hc8w-h2mf-hp59

medium2026-04-14

CVE-2026-25133-October Rain has Stored XSS via SVG Filter Bypass

octobercms/october · GHSA-gcqv-f29m-67gr

medium2026-04-14

CVE-2026-25125-October Rain has Environment Variable Exfiltration via INI Parser Interpolation

octobercms/october · GHSA-g6v3-wv4j-x9hg

high2026-04-14

CVE-2026-40885-goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access

patrickhener/goshs · GHSA-7h3j-592v-jcrp

medium2026-04-14

CVE-2026-40883-goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation

patrickhener/goshs · GHSA-jrq5-hg6x-j6g3

critical2026-04-14

CVE-2026-40884-goshs has an empty-username SFTP password authentication bypass

patrickhener/goshs · GHSA-c29w-qq4m-2gcv

high2026-04-14

CVE-2026-40876-SFTP root escape via prefix-based path validation in goshs

patrickhener/goshs · GHSA-5h6h-7rc9-3824

high2026-04-14

CVE-2026-40870-Decidim's comments API allows access to all commentable resources

decidim/decidim · GHSA-ghmh-q25g-gxxx

high2026-04-14

CVE-2026-40869-Decidim amendments can be accepted or rejected by anyone

decidim/decidim · GHSA-w5xj-99cg-rccm

high2026-04-14

CVE-2026-40683-OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean

openstack/keystone · GHSA-pfx2-9x9m-7ghx

high2026-04-14

CVE-2026-40868-kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token

kyverno/kyverno · GHSA-q93q-v844-jrqp