Security advisories

medium2026-03-27

CVE-2026-29180-A Fleet team maintainer can transfer hosts from any team via missing source team authorization

fleetdm/fleet · GHSA-m2h6-4xpq-qw3m

high2026-03-27

CVE-2026-4867-path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

pillarjs/path-to-regexp · GHSA-37ch-88jc-xwx2

high2026-03-27

CVE-2026-34076-Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

clerk/javascript · GHSA-gjxx-92w9-8v8f

low2026-03-27

CVE-2026-34073-cryptography has incomplete DNS name constraint enforcement on peer names

pyca/cryptography · GHSA-m959-cc7f-wv43

high2026-03-27

AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters

aws/aws-sdk-php · GHSA-27qh-8cxx-2cr5

high2026-03-27

CVE-2026-34070-LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

langchain-ai/langchain · GHSA-qh6h-p6c9-ff54

high2026-03-27

CVE-2026-34060-Ruby LSP has arbitrary code execution through branch setting

shopify/ruby-lsp · GHSA-c4r5-fxqw-vh93

high2026-03-27

CVE-2026-34046-Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check

langflow-ai/langflow · GHSA-8c4j-f57c-35cf

high2026-03-27

CVE-2026-34042-act: actions/cache server allows malicious cache injection

nektos/act · GHSA-x34h-54cw-9825

high2026-03-27

CVE-2026-34041-act: Unrestricted set-env and add-path command processing enables environment injection

nektos/act · GHSA-xmgr-9pqc-h5vw

high2026-03-27

CVE-2026-33989-@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools

mobile-next/mobile-mcp · GHSA-3p2m-h2v6-g9mx

high2026-03-27

CVE-2026-33981-Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

dgtlmoon/changedetection.io · GHSA-58r7-4wr5-hfx8

high2026-03-27

CVE-2026-33980-Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries

pab1it0/adx-mcp-server · GHSA-vphc-468g-8rfp

high2026-03-27

CVE-2026-33946-MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

modelcontextprotocol/ruby-sdk · GHSA-qvqr-5cv7-wh35

high2026-03-27

CVE-2026-33942-Saloon has insecure deserialization in AccessTokenAuthenticator

saloonphp/saloon · GHSA-rf88-776r-rcq9

low2026-03-27

CVE-2026-4963-Hugging Face Smolagents has an Injection issue

huggingface/smolagents · GHSA-54fq-v6x8-244g

high2026-03-27

CVE-2026-28369-Undertow is Vulnerable to HTTP Request/Response Smuggling

undertow-io/undertow · GHSA-vqqj-9cmv-hx43

high2026-03-27

CVE-2025-15381-MLFlow allows Tracing + Assessments Access

mlflow/mlflow · GHSA-g6pg-52vf-843h

high2026-03-27

CVE-2026-28368-Undertow is Vulnerable to HTTP Request/Response Smuggling

undertow-io/undertow · GHSA-8v4x-mgvp-p658

high2026-03-27

CVE-2026-28367-Undertow is Vulnerable to HTTP Request/Response Smuggling

undertow-io/undertow · GHSA-3gv6-g396-9v4r