Security advisories

critical2026-04-09

CVE-2026-29145-Apache Tomcat: CLIENT_CERT authentication does not fail as expected

apache/tomcat · GHSA-95jq-rwvf-vjx4

medium2026-04-09

CVE-2026-32990-Apache Tomcat has an Improper Input Validation vulnerability

apache/tomcat · GHSA-8mc5-53m5-3qj2

high2026-04-09

CVE-2026-29129-Apache Tomcat: Configured cipher preference order not preserved

apache/tomcat · GHSA-69cc-cv78-qc8g

high2026-04-09

CVE-2026-24880-Apache Tomcat has an HTTP Request/Response Smuggling vulnerability

apache/tomcat · GHSA-563x-q5rq-57qp

medium2026-04-09

Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users

gramps-project/gramps-web-api · GHSA-9gjv-jvm7-vv2v

low2026-04-09

CVE-2026-41915-OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)

openclaw/openclaw · GHSA-cm8v-2vh9-cxf3

high2026-04-09

CVE-2026-40069-bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts

sgbett/bsv-ruby-sdk · GHSA-9hfr-gw99-8rhx

high2026-04-09

CVE-2026-40070-bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

sgbett/bsv-ruby-sdk · GHSA-hc36-c89j-5f4j

medium2026-04-09

CVE-2026-39315-Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

unjs/unhead · GHSA-95h2-gj7x-gx9w

medium2026-04-09

CVE-2026-35195-Wasmtime has out-of-bounds write or crash when transcoding component model strings

bytecodealliance/wasmtime · GHSA-394w-hwhg-8vgm

low2026-04-09

CVE-2026-34988-Wasmtime has data leakage between pooling allocator instances

bytecodealliance/wasmtime · GHSA-6wgr-89rj-399p

low2026-04-09

CVE-2026-34983-Wasmtime has use-after-free bug after cloning `wasmtime::Linker`

bytecodealliance/wasmtime · GHSA-hfr4-7c6c-48w2

critical2026-04-09

CVE-2026-34971-Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

bytecodealliance/wasmtime · GHSA-jhxm-h53p-jm7w

medium2026-04-09

CVE-2026-34946-Wasmtime has host panic when Winch compiler executes `table.fill`

bytecodealliance/wasmtime · GHSA-q49f-xg75-m9xw

low2026-04-09

CVE-2026-34945-Wasmtime has host data leakage with 64-bit tables and Winch

bytecodealliance/wasmtime · GHSA-m9w2-8782-2946

medium2026-04-09

CVE-2026-34944-Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

bytecodealliance/wasmtime · GHSA-qqfj-4vcm-26hv

medium2026-04-09

CVE-2026-34943-Wasmtime has a possible panic when lifting `flags` component value

bytecodealliance/wasmtime · GHSA-m758-wjhj-p3jq

medium2026-04-09

CVE-2026-34942-Wasmtime: Panic when transcoding misaligned utf-16 strings

bytecodealliance/wasmtime · GHSA-jxhv-7h78-9775

medium2026-04-09

CVE-2026-34941-Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

bytecodealliance/wasmtime · GHSA-hx6p-xpx3-jvvv

medium2026-04-09

CVE-2026-5970-MetaGPT has an Injection issue

foundationagents/metagpt · GHSA-g977-h85w-h2xj