Security advisories

high2026-04-08

CVE-2026-39883-opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

open-telemetry/opentelemetry-go · GHSA-hfvc-g4fc-pqhx

medium2026-04-08

CVE-2026-39882-opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies

open-telemetry/opentelemetry-go · GHSA-w8rr-5gcm-pp58

medium2026-04-08

CVE-2026-56078-PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling

mervinpraison/praisonai · GHSA-766v-q9x3-g744

high2026-04-08

CVE-2026-39891-PraisonAI has Template Injection in Agent Tool Definitions

mervinpraison/praisonai · GHSA-hwg5-x759-7wjg

high2026-04-08

CVE-2026-39889-PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server

mervinpraison/praisonai · GHSA-f292-66h9-fpmf

critical2026-04-08

CVE-2026-39888-PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

mervinpraison/praisonai · GHSA-qf73-2hrx-xprp

critical2026-04-08

CVE-2026-39890-PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

mervinpraison/praisonai · GHSA-32vr-5gcf-3pw2

high2026-04-08

CVE-2026-39394-CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

ci4-cms-erp/ci4ms · GHSA-vfhx-5459-qhqh

high2026-04-08

CVE-2026-39393-CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass

ci4-cms-erp/ci4ms · GHSA-8rh5-4mvx-xj7j

medium2026-04-08

CVE-2026-39392-CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization

ci4-cms-erp/ci4ms · GHSA-fjpj-6qcq-6pw2

medium2026-04-08

CVE-2026-39391-CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List

ci4-cms-erp/ci4ms · GHSA-7cm9-v848-cfh2

medium2026-04-08

CVE-2026-39390-CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting

ci4-cms-erp/ci4ms · GHSA-x3hr-cp7x-44r2

medium2026-04-08

CVE-2026-39389-CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files

ci4-cms-erp/ci4ms · GHSA-9rxp-f27p-wv3h

medium2026-04-08

CVE-2026-40180-quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class

quarkiverse/quarkus-openapi-generator · GHSA-jx2w-vp7f-456q

high2026-04-08

CVE-2026-31040-stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution

sepinetam/stata-mcp · GHSA-jpcj-7wfg-mqxv

high2026-04-08

CVE-2026-27806-Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit

fleetdm/fleet · GHSA-rphv-h674-5hp2

medium2026-04-08

CVE-2026-39865-Axios HTTP/2 Session Cleanup State Corruption Vulnerability

axios/axios · GHSA-qj83-cq47-w5f8

medium2026-04-08

CVE-2026-5600-pretix: API leaks check-in data between events of the same organizer

pretix/pretix · GHSA-wr8q-c73g-m7gp

high2026-04-08

CVE-2026-34589-OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write

academysoftwarefoundation/openexr · GHSA-p8xc-w3q4-h64x

high2026-04-08

CVE-2026-34588-OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

academysoftwarefoundation/openexr · GHSA-588r-cr5c-w6hf