Security advisories

critical2026-04-03

CVE-2026-0545-mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization

mlflow/mlflow · GHSA-7qhf-v65m-g5f3

high2026-04-03

CVE-2025-68153-Juju has a resource poisoning vulnerability

juju/juju · GHSA-245v-p8fj-vwm2

medium2026-04-03

CVE-2025-68152-Juju: Read All Controller Logs From Compromised Workload

juju/juju · GHSA-j6f6-jp3p-53mw

medium2026-04-03

CVE-2026-34756-vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

vllm-project/vllm · GHSA-3mwp-wvh9-7528

low2026-04-03

CVE-2026-5468-Casdoor vulnerable to Stored XSS via Application formCss / formSideHtml

casdoor/casdoor · GHSA-w799-7525-rpr6

medium2026-04-03

CVE-2026-28736-Focalboard doesn't validate file ownership when serving uploaded files

mattermost-community/focalboard · GHSA-vph7-r229-qxpf

medium2026-04-03

CVE-2026-5469-Casdoor vulnerable to SSRF via crafted Webhook URL

casdoor/casdoor · GHSA-p8c7-hjc4-gwf8

high2026-04-03

CVE-2026-25773-Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements

mattermost-community/focalboard · GHSA-p32q-v29x-wq9r

low2026-04-03

CVE-2026-5467-Casdoor vulnerable to Open Redirect

casdoor/casdoor · GHSA-mj24-pqx2-6788

critical2026-04-03

CVE-2026-5463-pymetasploit3 vulnerable to command injection in console.run_module_with_output()

danmcinerney/pymetasploit3 · GHSA-qpc3-8vqg-8g6w

medium2026-04-03

CVE-2026-35544-Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages

roundcube/roundcubemail · GHSA-xpqh-grpw-4xmg

medium2026-04-03

CVE-2026-35539-Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode

roundcube/roundcubemail · GHSA-x4q5-8j5g-hpjc

medium2026-04-03

CVE-2026-35545-Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message

roundcube/roundcubemail · GHSA-w846-74jr-76cv

medium2026-04-03

CVE-2026-35540-Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages

roundcube/roundcubemail · GHSA-vxg2-hhgr-37fx

low2026-04-03

CVE-2026-35537-Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler

roundcube/roundcubemail · GHSA-rxj3-rrwm-pj4r

medium2026-04-03

CVE-2026-35543-Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message

roundcube/roundcubemail · GHSA-j2g6-8rvg-7mf6

low2026-04-03

CVE-2026-35538-Roundcube Webmail: Unsanitized IMAP SEARCH command arguments

roundcube/roundcubemail · GHSA-8jr8-v43g-5c57

medium2026-04-03

CVE-2026-35542-Roundcube: Bypass of remote image blocking via crafted BODY background attribute

roundcube/roundcubemail · GHSA-5hf6-crg4-fg59

medium2026-04-03

CVE-2026-35541-Roundcube Webmail: Incorrect password comparison in the password plugin

roundcube/roundcubemail · GHSA-46pv-mj2g-93gh

high2026-04-03

CVE-2026-35536-Tornado has cookie attribute injection via .RequestHandler.set_cookie

tornadoweb/tornado · GHSA-fqwm-6jpj-5wxc