Security advisories

high2026-04-10

CVE-2026-35205-Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

helm/helm · GHSA-q5jf-9vfq-h4h7

high2026-04-10

CVE-2026-35204-Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

helm/helm · GHSA-vmx8-mqv2-9gmg

medium2026-04-10

CVE-2026-35186-Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend

bytecodealliance/wasmtime · GHSA-f984-pcp8-v2p7

critical2026-04-10

CVE-2026-34987-Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

bytecodealliance/wasmtime · GHSA-xx5w-cvp6-jv83

medium2026-04-10

CVE-2026-35594-Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

go-vikunja/vikunja · GHSA-96q5-xm3p-7m84

high2026-04-10

CVE-2026-34727-Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path

go-vikunja/vikunja · GHSA-8jvc-mcx6-r4cg

high2026-04-10

CVE-2026-39304- Apache ActiveMQ: Denial of Service via Out of Memory vulnerability

apache/activemq · GHSA-5568-6qcg-g7fx

high2026-04-10

CVE-2026-22750-Spring Cloud Gateway's SSL bundle configuration silently bypassed

spring-cloud/spring-cloud-gateway · GHSA-hwqh-2684-54fc

critical2026-04-10

CVE-2026-1115-parisneo/lollms vulnerable to stored XSS in the social feature

parisneo/lollms · GHSA-8wrq-fv5f-pfp2

low2026-04-10

CVE-2026-6011-OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts

openclaw/openclaw · GHSA-52vj-fvrv-7q82

low2026-04-10

CVE-2026-33551-OpenStack Keystone: Restricted application credentials can create EC2 credentials

openstack/keystone · GHSA-4phw-6824-6cfp

high2026-04-09

CVE-2026-34487-Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

apache/tomcat · GHSA-x4m4-345f-5h5g

medium2026-04-09

CVE-2026-5972-FoundationAgents MetaGPT vulnerable to os command injection via the Terminal.run_command

foundationagents/metagpt · GHSA-wp29-qmvj-frvp

high2026-04-09

CVE-2026-34483-Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

apache/tomcat · GHSA-rv64-5gf8-9qq8

medium2026-04-09

CVE-2026-5973-FoundationAgents MetaGPT vulnerable to OS Command Injection in metagpt/utils/common.py

foundationagents/metagpt · GHSA-qw5f-qpq5-ppfg

medium2026-04-09

CVE-2026-5974-FoundationAgents MetaGPT vulnerable to OS Command Injection in metagpt/tools/libs/terminal.py

foundationagents/metagpt · GHSA-fcc8-4q7h-wvwc

high2026-04-09

CVE-2026-34486-Apache Tomcat Missing Encryption of Sensitive Data vulnerability

apache/tomcat · GHSA-69r9-qgr7-g2wj

medium2026-04-09

CVE-2026-34500-Apache Tomcat: CLIENT_CERT authentication does not fail as expected

apache/tomcat · GHSA-24j9-x2wg-9qv6

high2026-04-09

CVE-2026-29146-Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

apache/tomcat · GHSA-h468-7pvh-8vr8

medium2026-04-09

CVE-2026-25854-Apache Tomcat has an Open Redirect vulnerability

apache/tomcat · GHSA-9m3c-qcxr-9x87