Security advisories

high2026-04-14

Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach

kyverno/kyverno · GHSA-fmqp-4wfc-w3v7

high2026-04-14

Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF

kyverno/kyverno · GHSA-qr4g-8hrp-c4rw

low2026-04-14

Multiple security fixes in justhtml

emilstenstrom/justhtml · GHSA-4p64-v8f5-r2gx

high2026-04-14

CVE-2026-40176-Composer has a command injection via malicious perforce repository

composer/composer · GHSA-wg36-wvj6-r67p

medium2026-04-14

CVE-2026-24907-October CMS has Stored XSS in Event Log Mail Preview

octobercms/october · GHSA-j4j5-9x6g-rgxc

medium2026-04-14

CVE-2026-24906-October CMS has Stored XSS in Backend Editor Markup Classes

octobercms/october · GHSA-6qmh-j78v-ffp7

medium2026-04-14

CVE-2026-22692-October Rain has a Twig Sandbox Bypass via Collection Methods

octobercms/october · GHSA-m5qg-jc75-4jp6

high2026-04-14

CVE-2026-40261-Composer has a command injection via malicious perforce reference

composer/composer · GHSA-gqw4-4w2p-838q

medium2026-04-14

CVE-2026-40255-@adonisjs/http-server has an Open Redirect vulnerability

adonisjs/http-server · GHSA-6qvv-pj99-48qm

medium2026-04-14

CVE-2026-40249-free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors

free5gc/udr · GHSA-gx38-8h33-pmxr

high2026-04-14

CVE-2026-40248-free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions

free5gc/udr · GHSA-jgq2-qv8v-5cmj

high2026-04-14

CVE-2026-40247-free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions

free5gc/udr · GHSA-x5r2-r74c-3w28

high2026-04-14

CVE-2026-40246-free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions

free5gc/udr · GHSA-g9cw-qwhf-24jp

high2026-04-14

CVE-2026-40245-free5gc UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication

free5gc/udr · GHSA-wrwh-rpq4-87hf

medium2026-04-14

CVE-2026-40312-ImageMagick has an off-by-one error in MSL decoder could result in crash

imagemagick/imagemagick · GHSA-5xg3-585r-9jh5

medium2026-04-14

CVE-2026-40311-ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

imagemagick/imagemagick · GHSA-r83h-crwp-3vm7

medium2026-04-14

CVE-2026-40310-ImageMagick has a heap out-of-bounds write in JP2 encoder

imagemagick/imagemagick · GHSA-pwg5-6jfc-crvh

medium2026-04-14

CVE-2026-40183-ImageMagick has a heap buffer overflow when encoding JXL image with a 16-bit float

imagemagick/imagemagick · GHSA-jvgr-9ph5-m8v4

medium2026-04-14

CVE-2026-40169-ImageMagick has a heap buffer overflow (WRITE) in the YAML and JSON encoders.

imagemagick/imagemagick · GHSA-5592-p365-24xh

medium2026-04-14

CVE-2026-33905-ImageMagick has an out-of-bounds read in sample operation

imagemagick/imagemagick · GHSA-pcvx-ph33-r5vv