Security advisories

medium2026-04-14

CVE-2026-33902- ImageMagick has a Stack Overflow via Recursive FX Expression Parsing

imagemagick/imagemagick · GHSA-f4qm-vj5j-9xpw

high2026-04-14

CVE-2026-38530-Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php

krayin/laravel-crm · GHSA-rm5f-3c25-p4cw

high2026-04-14

CVE-2026-38529-Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php

krayin/laravel-crm · GHSA-r8rp-5f55-5j9x

high2026-04-14

CVE-2026-38527-Webkul Krayin CRM has Server-Side Request Forgery (SSRF)

krayin/laravel-crm · GHSA-fpx9-9hq8-w2xc

high2026-04-14

CVE-2026-38532-Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php

krayin/laravel-crm · GHSA-2xx8-j85v-j7wh

medium2026-04-14

CVE-2026-37980-Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page

keycloak/keycloak · GHSA-m32f-8vh9-2hh3

critical2026-04-14

CVE-2025-61260-OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

openai/codex · GHSA-xrxf-jgv3-qmrm

medium2026-04-14

CVE-2025-13822-MCPHub has an authentication bypass

samanhappy/mcphub · GHSA-9vq7-9h42-j88h

medium2026-04-14

CVE-2026-33929-Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

apache/pdfbox · GHSA-gcj8-76p4-g2fq

medium2026-04-14

CVE-2026-40491-gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall

wkentaro/gdown · GHSA-76hw-p97h-883f

medium2026-04-14

CVE-2026-40895-follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

follow-redirects/follow-redirects · GHSA-r4q5-vmmm-2653

medium2026-04-14

CVE-2026-40606-mitmproxy has an LDAP Injection

mitmproxy/mitmproxy · GHSA-527g-3w9m-29hv

medium2026-04-14

CVE-2026-40490-AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects

asynchttpclient/async-http-client · GHSA-cmxv-58fp-fm3g

low2026-04-14

Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID

fatfreecrm/fat_free_crm · GHSA-9pm8-vwc5-w2hm

low2026-04-14

Kimai leaks API Token Hash via Invoice Twig Template

kimai/kimai · GHSA-rh42-6rj2-xwmc

low2026-04-14

Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler

kimai/kimai · GHSA-3jp4-mhh4-gcgr

medium2026-04-14

CVE-2026-40476-graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation

webonyx/graphql-php · GHSA-68jq-c3rv-pcrr

low2026-04-14

Rand is unsound with a custom logger using rand::rng()

rust-random/rand · GHSA-cq8v-f236-94qc

medium2026-04-14

CVE-2026-39984-Sigstore Timestamp Authority has Improper Certificate Validation in verifier

sigstore/timestamp-authority · GHSA-xm5m-wgh2-rrg3

low2026-04-14

CVE-2026-32270-Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments

craftcms/commerce · GHSA-3vxg-x5f8-f5qf