Security advisories

medium2026-04-06

CVE-2026-35492-kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write

kedro-org/kedro-plugins · GHSA-cjg8-h5qc-hrjv

medium2026-04-06

CVE-2026-35201-rdiscount has an Out-of-bounds Read

davidfstr/rdiscount · GHSA-6r34-94wq-jhrc

high2026-04-06

CVE-2026-35172-Distribution: stale blob access resurrection via repo-scoped redis descriptor cache invalidation

distribution/distribution · GHSA-f2g3-hh2r-cwgc

critical2026-04-06

CVE-2026-35035-CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-5ghq-42rg-769x

high2026-04-06

CVE-2026-33540-Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm

distribution/distribution · GHSA-3p65-76g6-3w7r

medium2026-04-06

CVE-2026-26981-OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp

academysoftwarefoundation/openexr · GHSA-q6vj-wxvf-5m8c

medium2026-04-06

CVE-2025-64183-OpenEXR has use after free in PyObject_StealAttrString

academysoftwarefoundation/openexr · GHSA-57cw-j6vp-2p9m

medium2026-04-06

CVE-2025-64182-OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()

academysoftwarefoundation/openexr · GHSA-vh63-9mqx-wmjr

low2026-04-06

CVE-2025-64181-OpenEXR Makes Use of Uninitialized Memory

academysoftwarefoundation/openexr · GHSA-3h9h-qfvw-98hq

low2026-04-06

CVE-2026-37977-Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim

keycloak/keycloak · GHSA-5v8v-xvjv-57x7

low2026-04-06

CVE-2026-5603-@elgentos/magento2-dev-mcp vulnerable to command injection

elgentos/magento2-dev-mcp · GHSA-xqv9-qr76-hfq2

low2026-04-06

CVE-2026-5602-@nor2/heim-mcp vulnerable to command injection

nor2-io/heim-mcp · GHSA-wx4p-jr66-jfp9

low2026-04-05

CVE-2026-5559-PyBlade: SSTI/RCE via Bypassed AST Validation in sandbox.py

antaresmugisho/pyblade · GHSA-23jg-5f8m-gw8c

medium2026-04-04

CVE-2016-20054-Nodcms contains a cross-site request forgery vulnerability

khodakhah/nodcms · GHSA-3qcm-pj6q-w4c5

high2026-04-04

CVE-2026-35464-pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)

pyload/pyload · GHSA-4744-96p5-mp2j

high2026-04-04

CVE-2026-35463-pyLoad: Improper Neutralization of Special Elements used in an OS Command

pyload/pyload · GHSA-w48f-wwwf-f5fr

critical2026-04-04

CVE-2026-35459-pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)

pyload/pyload · GHSA-7gvf-3w72-p2pg

medium2026-04-04

CVE-2026-40072-web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling

ethereum/web3.py · GHSA-5hr4-253g-cpx2

high2026-04-04

CVE-2026-35457-libp2p-rendezvous: Unbounded rendezvous DISCOVER cookies enable remote memory exhaustion

libp2p/rust-libp2p · GHSA-v5hw-cv9c-rpg7

high2026-04-04

CVE-2026-35405-libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers

libp2p/rust-libp2p · GHSA-cqfx-gf56-8x59