Security advisories

critical2026-04-07

CVE-2026-33439-OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

openidentityplatform/openam · GHSA-2cqq-rpvq-g5qj

high2026-04-07

CVE-2026-4740-Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation

open-cluster-management-io/ocm · GHSA-q4gv-pjmh-c735

low2026-04-07

CVE-2026-4277-Django vulnerable to privilege abuse in GenericInlineModelAdmin

django/django · GHSA-pwjp-ccjc-ghwg

high2026-04-07

CVE-2026-3902-Django vulnerable to ASGI header spoofing via underscore/hyphen conflation

django/django · GHSA-mvfq-ggxm-9mc5

low2026-04-07

CVE-2026-4292-Django vulnerable to privilege abuse in ModelAdmin.list_editable

django/django · GHSA-mmwr-2jhp-mc7j

high2026-04-07

CVE-2026-33034-Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit

django/django · GHSA-933h-hp56-hf7m

medium2026-04-07

CVE-2026-33033-Django has potential DoS via MultiPartParser through crafted multipart uploads

django/django · GHSA-5mf9-h53q-7mhq

medium2026-04-07

CVE-2026-33865-MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface

mlflow/mlflow · GHSA-fh64-r2vc-xvhr

high2026-04-07

CVE-2026-35554-Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition

apache/kafka · GHSA-5qcv-4rpc-jp93

medium2026-04-07

CVE-2026-33866-MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint

mlflow/mlflow · GHSA-46r5-x6jq-v8g6

high2026-04-07

CVE-2026-34197-Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

apache/activemq · GHSA-rxpj-7qvf-xv32

medium2026-04-07

CVE-2026-33227-Apache ActiveMQ: Improper validation and restriction of a classpath path name

apache/activemq · GHSA-h2h4-5m64-m273

critical2026-04-07

CVE-2026-1114-LoLLMs is vulnerable to Improper Access Control through weak secret key

parisneo/lollms · GHSA-9296-v3fr-j92j

medium2026-04-07

CVE-2026-1839-HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

huggingface/transformers · GHSA-69w3-r845-3855

critical2026-04-06

CVE-2026-35615-PraisonAI Has Path Traversal in FileTools

mervinpraison/praisonai · GHSA-693f-pf34-72c5

high2026-04-06

CVE-2026-39308-PraisonAI recipe registry publish path traversal allows out-of-root file write

mervinpraison/praisonai · GHSA-r9x3-wx45-2v7f

high2026-04-06

CVE-2026-39306-PraisonAI recipe registry pull path traversal writes files outside the chosen output directory

mervinpraison/praisonai · GHSA-4rx4-4r3x-6534

critical2026-04-06

CVE-2026-39305-PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator

mervinpraison/praisonai · GHSA-jfxc-v5g9-38xr

high2026-04-06

CVE-2026-39307-PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction

mervinpraison/praisonai · GHSA-4ph2-f6pf-79wv

medium2026-04-06

CVE-2026-35480-go-ipld-prime: DAG-CBOR decoder unbounded memory allocation from CBOR headers

ipld/go-ipld-prime · GHSA-378j-3jfj-8r9f