Security advisories

critical2026-03-27

CVE-2026-22738-Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key

spring-projects/spring-ai · GHSA-fvh3-672c-7p6c

high2026-03-27

CVE-2026-28377-Grafana Tempo has Inadequate Encryption Strength

grafana/tempo · GHSA-ffqx-q65f-36jf

high2026-03-26

C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922)

camptocamp/c2cciutils · GHSA-wcjx-v2wj-xg87

low2026-03-26

Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter

nodemailer/nodemailer · GHSA-c7w3-x93f-qmm8

medium2026-03-26

Harbor: LDAP password and OIDC secret are not redacted in the audit log

goharbor/harbor · GHSA-prh4-vhfh-24mj

high2026-03-26

CVE-2026-33943-Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

capricorn86/happy-dom · GHSA-6q6h-j7hj-3r64

medium2026-03-26

CVE-2026-33916-Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

handlebars-lang/handlebars.js · GHSA-2qvq-rjwj-gvw9

low2026-03-26

Loofah has improper detection of disallowed URIs via `allowed_uri?`

flavorjones/loofah · GHSA-2j22-pr5w-6gq8

medium2026-03-26

CVE-2026-33907-Ella Core Panics during NAS Authentication Response/Failure with missing IEs

ellanetworks/core · GHSA-55q8-2gwx-29pc

high2026-03-26

CVE-2026-33906-Ella Core has Privilege Escalation via Database Restore by NetworkManager role

ellanetworks/core · GHSA-87j9-m7x6-hvw2

medium2026-03-26

CVE-2026-33904-Ella Core has a Denial of Service via SCTP connection cleanup deadlock

ellanetworks/core · GHSA-9h59-p45g-445h

medium2026-03-26

CVE-2026-33903-Ella Core panics when processing a crafted NGAP LocationReport message

ellanetworks/core · GHSA-f2f3-9cx3-wcmf

low2026-03-26

ImageMagick: META reader memory leak in the APP1JPEG input path

imagemagick/imagemagick · GHSA-9r56-3gjq-hqf7

low2026-03-26

ImageMagick has possible memory leak in ASHLAR coder when action fails

imagemagick/imagemagick · GHSA-6p22-q7w5-33pg

medium2026-03-26

Apollo Router Core: Browser Bug Enables Bypass of XS-Search Prevention via Read-Only Cross-Site Request Forgery

apollographql/router · GHSA-hff2-gcpx-8f4p

high2026-03-26

CVE-2026-33896-Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

digitalbazaar/forge · GHSA-2328-f5f3-gj25

high2026-03-26

CVE-2026-33895-Forge has signature forgery in Ed25519 due to missing S > L check

digitalbazaar/forge · GHSA-q67f-28xg-22rw

high2026-03-26

CVE-2026-33894-Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

digitalbazaar/forge · GHSA-ppp5-5v6c-4jwp

high2026-03-26

CVE-2026-33891-Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

digitalbazaar/forge · GHSA-5m6q-g25r-mvwx

medium2026-03-26

Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

apollographql/apollo-server · GHSA-9q82-xgwf-vj6h