Security advisories

medium2026-04-09

CVE-2026-34538-Apache Airflow has an authorization bypass in DagRun wait endpoint

apache/airflow · GHSA-r7vr-m4jw-r794

high2026-04-09

CVE-2025-62188-Apache DolphinScheduler vulnerable to sensitive information disclosure

apache/dolphinscheduler · GHSA-3cjc-vhfm-ffp2

medium2026-04-09

CVE-2026-5842-decolua 9router vulnerable to authorization bypass

decolua/9router · GHSA-xrrh-p7f2-27vm

low2026-04-09

CVE-2026-5833-awwaiid mcp-server-taskwarrior vulnerable to command injection

awwaiid/mcp-server-taskwarrior · GHSA-95hg-3c55-xf9x

medium2026-04-09

CVE-2026-5832-api-lab-mcp vulnerable to SSRF

atototo/api-lab-mcp · GHSA-crh9-3gjh-m6gc

medium2026-04-09

CVE-2026-5831-Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts

agions/taskflow-ai · GHSA-3xp3-pr8x-f755

critical2026-04-08

CVE-2026-40088-PraisonAI Vulnerable to OS Command Injection

mervinpraison/praisonai · GHSA-2763-cj5r-c79m

medium2026-04-08

CVE-2026-40293-OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response

openfga/openfga · GHSA-68m9-983m-f3v5

medium2026-04-08

CVE-2026-40087-LangChain has incomplete f-string validation in prompt templates

langchain-ai/langchain · GHSA-926x-3r5x-gfhw

critical2026-04-08

CVE-2026-39987-Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

marimo-team/marimo · GHSA-2679-6mx9-h9xc

high2026-04-08

Pretext: Algorithmic Complexity (DoS) in the text analysis phase

chenglou/pretext · GHSA-5478-66c3-rhxr

high2026-04-08

CVE-2026-39983-basic-ftp has FTP Command Injection via CRLF

patrickjuchli/basic-ftp · GHSA-chqc-8p9q-pq6q

high2026-04-08

CVE-2026-39981-AGiXT Vulnerable to Path Traversal in safe_join()

josh-xt/agixt · GHSA-5gfj-64gh-mgmw

high2026-04-08

CVE-2026-39976-Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens

laravel/passport · GHSA-349c-2h2f-mxf6

high2026-04-08

CVE-2026-39974-n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode

czlonkowski/n8n-mcp · GHSA-4ggg-h7ph-26qr

high2026-04-08

CVE-2026-39972-mercure has Topic Selector Cache Key Collision

dunglas/mercure · GHSA-hwr4-mq23-wcv5

high2026-04-08

CVE-2026-39959-Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service

tmds/tmds.dbus · GHSA-xrw6-gwf8-vvr9

medium2026-04-08

CVE-2026-39892-Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

pyca/cryptography · GHSA-p423-j2cm-9vmq

medium2026-04-08

CVE-2026-39901-monetr: Protected Transactions Deletable via PUT

monetr/monetr · GHSA-hqxq-hwqf-wg83

high2026-04-08

CVE-2026-39885-mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications

agentfront/frontmcp · GHSA-v6ph-xcq9-qxxj