Security advisories

high2026-04-07

CVE-2026-35568-Java-SDK has a DNS Rebinding Vulnerability

modelcontextprotocol/java-sdk · GHSA-8jxr-pr72-r468

high2026-04-07

CVE-2026-35533-Local settings bypass config trust checks

jdx/mise · GHSA-436v-8fw5-4mj8

high2026-04-07

CVE-2026-35406-netavark has incorrect error handling for malformed tcp packets

containers/aardvark-dns · GHSA-hfpq-x728-986j

high2026-04-07

CVE-2026-29181-OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

open-telemetry/opentelemetry-go · GHSA-mh2q-q3fh-2475

medium2026-04-07

CVE-2026-22680-OpenViking contains a missing authorization vulnerability in the task polling endpoints

volcengine/openviking · GHSA-h336-2wxm-pr6q

high2026-04-07

CVE-2026-27314-Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator

apache/cassandra · GHSA-qxpc-96fq-wwmg

medium2026-04-07

CVE-2025-70844-yaffa vulnerable to Cross Site Scripting

kantorge/yaffa · GHSA-pq95-94c9-j987

medium2026-04-07

CVE-2026-27315-Apache Cassandra has sensitive Information Leak in cqlsh

apache/cassandra · GHSA-fh34-c629-p8xj

critical2026-04-07

CVE-2026-33816-Memory-safety vulnerability in github.com/jackc/pgx/v5.

jackc/pgx · GHSA-9jj7-4m8r-rfcm

high2026-04-07

Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags

gotenberg/gotenberg · GHSA-qmwh-9m9c-h36m

high2026-04-07

CVE-2026-35458-Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature

gotenberg/gotenberg · GHSA-fmwg-qcqh-m992

medium2026-04-07

CVE-2026-40045-OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://

openclaw/openclaw · GHSA-83f3-hh45-vfw9

medium2026-04-07

CVE-2026-41407-OpenClaw: Shared-secret comparison call sites leaked length information through timing

openclaw/openclaw · GHSA-jj6q-rrrf-h66h

medium2026-04-07

CVE-2026-41354-OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

openclaw/openclaw · GHSA-rxmx-g7hr-8mx4

medium2026-04-07

CVE-2026-41372-OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

openclaw/openclaw · GHSA-fh32-73r9-rgh5

medium2026-04-07

OpenClaw: pnpm dlx approvals did not bind local script operands

openclaw/openclaw · GHSA-w6wx-jq6j-6mcj

medium2026-04-07

OpenClaw: Windows-compatible env override keys could bypass system.run approval binding

openclaw/openclaw · GHSA-98ch-45wp-ch47

medium2026-04-07

CVE-2026-41339-OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

openclaw/openclaw · GHSA-2f7j-rp58-mr42

medium2026-04-07

CVE-2026-41295-OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup

openclaw/openclaw · GHSA-2qrv-rc5x-2g2h

medium2026-04-07

CVE-2026-41298-OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill

openclaw/openclaw · GHSA-5hff-46vh-rxmw