Security advisories

medium2026-04-13

CVE-2026-40179-Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

prometheus/prometheus · GHSA-vffh-x6r8-xx99

high2026-04-13

CVE-2026-35582-Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix

nationalsecurityagency/emissary · GHSA-3p24-9x7v-7789

high2026-04-13

CVE-2026-34984-External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine

external-secrets/external-secrets · GHSA-r2pg-r6h7-crf3

medium2026-04-13

CVE-2026-34069-nimiq-consensus panics via RequestMacroChain micro-block locator

nimiq/core-rs-albatross · GHSA-48m6-486p-9j8p

high2026-04-13

CVE-2026-28291-simple-git Affected by Command Execution via Option-Parsing Bypass

steveukx/git-js · GHSA-jcxm-m3jx-f287

critical2026-04-13

CVE-2026-23891-Decidim has a cross-site scripting (XSS) in user name

decidim/decidim · GHSA-fc46-r95f-hq7g

high2026-04-13

CVE-2026-33858-Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API

apache/airflow · GHSA-mc4f-r875-v87w

medium2026-04-13

CVE-2025-66236-Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

apache/airflow · GHSA-j86x-fwp2-qh7v

high2026-04-13

CVE-2026-1462-Keras has an untrusted deserialization vulnerability

keras-team/keras · GHSA-4f3f-g24h-fr8m

high2026-04-13

CVE-2026-34476-Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server

apache/skywalking-mcp · GHSA-c4hg-6933-x62x

high2026-04-13

CVE-2026-35337-Apache Storm: Deserialization of Untrusted Data vulnerability

apache/storm · GHSA-jf89-3q6q-vcgr

medium2026-04-13

CVE-2026-35565- Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata

apache/storm · GHSA-f2hp-qw27-8wfq

critical2026-04-13

CVE-2026-4810-Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability

google/adk-python · GHSA-rg7c-g689-fr3x

high2026-04-12

CVE-2019-25710-Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php

dolibarr/dolibarr · GHSA-xxxg-x793-7fq3

low2026-04-12

CVE-2026-6125-Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression

dromara/warm-flow · GHSA-822v-8w6h-5jxp

low2026-04-12

CVE-2026-6111-MetaGPT affected by server-side request forgery in metagpt/utils/common.py

foundationagents/metagpt · GHSA-r5v8-c28h-f8r8

medium2026-04-12

CVE-2026-6110-MetaGPT has an eval injection in metagpt/strategy/tot.py

foundationagents/metagpt · GHSA-xr7v-m9px-q4qj

low2026-04-12

CVE-2026-6109-MetaGPT has an eval injection via a cross-site request forgery attack

foundationagents/metagpt · GHSA-w287-wwhf-95vv

critical2026-04-11

CVE-2026-5059-aws-mcp has a Command Injection Remote Code Execution Vulnerability

alexei-led/aws-mcp-server · GHSA-fgmx-xfp3-w28p

critical2026-04-10

Daptin has Unauthenticated Path Traversal and Zip Slip

daptin/daptin · GHSA-9cp7-j3f8-p5jx